CVE-2026-42575 — apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded . — CVE Database · The Intelligence Room