TI-2022-16356 CVE-2022-35929 · GHSA-vjxv-45g9-9296
False positive signature verification in cosign
Priority HIGH 76
cosign is a container signing and verification utility.
sigstore
Records40All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9
Exploited now
sigstore records in CISA KEVNo sigstore vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
40 records
TI-2026-36084 CVE-2026-48815 · GHSA-52v5-jr5w-gjxr
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
Priority HIGH 72
sigstore-js provides JavaScript libraries for interacting with Sigstore services.
TI-2024-19670 CVE-2024-29903 · GHSA-95pr-fxf5-86gv
Cosign vulnerable to machine-wide denial of service via malicious artifacts
Priority HIGH 66
Cosign provides code signing and transparency for containers and binaries.
TI-2026-18290 CVE-2026-22772 · GHSA-59jp-pj84-45mr
Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Priority HIGH 65
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2026-36085 CVE-2026-48816 · GHSA-xgjw-pm74-86q4
sigstore-js: Insufficient Verification of Data Authenticity
Priority MEDIUM 62
sigstore-js provides JavaScript libraries for interacting with Sigstore services.
TI-2024-19669 CVE-2024-29902 · GHSA-88jx-383q-w4qc
Cosign vulnerable to system-wide denial of service via malicious attachments
Priority MEDIUM 60
Cosign provides code signing and transparency for containers and binaries.
TI-2026-36028 CVE-2026-48758 · GHSA-jfc7-64v2-mr8c
sigstore-js: DSSE payloadType type-binding failure
Priority MEDIUM 58
sigstore-js provides JavaScript libraries for interacting with Sigstore services.
TI-2026-32278 CVE-2026-44310 · GHSA-7c37-gx6w-8vc5
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Priority MEDIUM 58
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity.
TI-2024-35729 CVE-2024-53267 · GHSA-q4xm-6fjc-5f6w
Vulnerability with bundle verification in sigstore-java
Priority MEDIUM 58
sigstore-java is a sigstore java client for interacting with sigstore infrastructure.
TI-2022-16479 CVE-2022-36056 · GHSA-8gw7-4j42-w388
Vulnerabilities with blob verification in sigstore cosign
Priority MEDIUM 58
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure.
TI-2026-32277 CVE-2026-44309 · GHSA-7rmh-48mx-2vwc
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
Priority MEDIUM 57
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity.
TI-2026-36061 CVE-2026-48791 · GHSA-qqw8-7c2r-jxch
Sigstore Java has a vulnerability with bundle verification of integratedTime
Priority MEDIUM 44
sigstore-java is a sigstore java client for interacting with sigstore infrastructure.
TI-2024-36256 CVE-2024-54140 · GHSA-jp26-88mw-89qr
sigstore-java has a vulnerability with bundle verification
Priority MEDIUM 44
sigstore-java is a sigstore java client for interacting with sigstore infrastructure.
TI-2026-42705 CVE-2026-59891 · GHSA-pf56-329r-95rw
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Priority MEDIUM 43
sigstore-js provides JavaScript libraries for interacting with Sigstore services.
TI-2024-34651 CVE-2024-51746 · GHSA-8pmp-678w-c8xx
Use of incorrect Rekor entries during verification in gitsign
Priority MEDIUM 43
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity.
TI-2023-14386 CVE-2023-30551 · GHSA-2h5h-59f5-c5x9
Rekor's compressed archives can result in OOM conditions
Priority MEDIUM 41
Rekor is an open source software supply chain transparency log.
TI-2022-16357 CVE-2022-35930 · GHSA-739f-hw6h-7wq8
Ability to bypass attestation verification in sigstore PolicyController
Priority MEDIUM 41
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters.
TI-2026-36632 CVE-2026-49478 · GHSA-f5mr-q85p-6hh6
Server-side request forgery in sigstore fulcio
Priority LOW 39
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2026-35984 CVE-2026-48702 · GHSA-47q9-m4ww-924m
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Priority LOW 39
Rekor is a software supply chain transparency log.
TI-2026-24383 CVE-2026-31830 · GHSA-mhg6-2q2v-9h2c
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
Priority LOW 39
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project.
TI-2025-40975 CVE-2025-66564 · GHSA-4qg8-fj49-pxjh
Sigstore Timestamp Authority allocates excessive memory during request parsing
Priority LOW 39
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw
Fulcio allocates excessive memory during token parsing
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2026-36739 CVE-2026-49835 · GHSA-9c54-x2g4-v92j
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
Priority LOW 34
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
TI-2024-30444 CVE-2024-45395 · GHSA-cq38-jh5f-37mq
Unbounded loop over untrusted input can lead to endless data attack
Priority LOW 33
sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large…
TI-2026-82694 CVE-2026-118763 · GHSA-j63v-mwhm-56jx
@sigstore/oci leaks registry credentials to cross-host upload URLs
Priority LOW 32
sigstore-js provides JavaScript libraries for interacting with Sigstore services.