Ddistribution

Products

Exploited and recent CVEs

• CVE-2026-85747 Medium 6.8 Distribution: Client `manifests.Get()` does not verify returned content against requested digest 0.2%
• CVE-2026-41888 Medium 6.3 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration 0.3%
• CVE-2026-35172 High 7.5 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation 0.5%
• CVE-2026-33540 High 7.5 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm 0.3%
• CVE-2025-24976 Medium 6.6 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT 0.4%