TI-2026-28380 CVE-2026-39395 · GHSA-w6c6-c85g-mmv6
Cosign's verify-blob-attestation reports false positive when payload parsing fails
Priority LOW 24
Cosign provides code signing and transparency for containers and binaries.
Vulnerabilities
9 records
TI-2026-19440 CVE-2026-24122 · GHSA-wfqv-66vq-46rm
Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
Priority LOW 17
Cosign provides code signing and transparency for containers and binaries.
TI-2026-18230 CVE-2026-22703 · GHSA-whqx-f9j3-ch6m
Cosign verification accepts any valid Rekor entry under certain conditions
Priority LOW 24
Cosign provides code signing and transparency for containers and binaries.
TI-2024-19670 CVE-2024-29903 · GHSA-95pr-fxf5-86gv
Cosign vulnerable to machine-wide denial of service via malicious artifacts
Priority HIGH 66
Cosign provides code signing and transparency for containers and binaries.
TI-2024-19669 CVE-2024-29902 · GHSA-88jx-383q-w4qc
Cosign vulnerable to system-wide denial of service via malicious attachments
Priority MEDIUM 60
Cosign provides code signing and transparency for containers and binaries.
TI-2023-25220 CVE-2023-46737 · GHSA-vfp6-jrw2-99g9
Possible endless data attack from attacker-controlled registry in cosign
Priority LOW 25
Cosign is a sigstore signing tool for OCI containers.
TI-2022-16479 CVE-2022-36056 · GHSA-8gw7-4j42-w388
Vulnerabilities with blob verification in sigstore cosign
Priority MEDIUM 58
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure.
TI-2022-16356 CVE-2022-35929 · GHSA-vjxv-45g9-9296
False positive signature verification in cosign
Priority HIGH 76
cosign is a container signing and verification utility.
TI-2022-07701 CVE-2022-23649 · GHSA-ccxc-vr6p-4858
Improper Certificate Validation in Cosign
Priority LOW 15
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project.