in-toto

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

in-toto records in CISA KEV

No in-toto vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records

TI-2025-38643 CVE-2025-62375 · GHSA-72c7-4g63-hpw5

LOW 36

go-witness and witness are Go modules for generating attestations.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00204 Published 2025-10-15 Partial fix · 0.9.1 CWE-295

TI-2021-17929 CVE-2021-41087 · GHSA-vrxp-mg9f-hwf3

LOW 29

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0043 Published 2021-09-21 Fixed in 0.3.0 CWE-345

TI-2023-15380 CVE-2023-32076 · GHSA-wc64-c5rv-32pf

LOW 24

in-toto is a framework to protect supply chain integrity.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00243 Published 2023-05-10 Fixed in 2.0.0 CWE-15