Vulnerabilities

TI-2025-38643 CVE-2025-62375 · GHSA-72c7-4g63-hpw5

go-witness Improper Verification of AWS EC2 Identity Documents

LOW 36

go-witness and witness are Go modules for generating attestations.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00204 Published 2025-10-15 Partial fix · 0.9.1 CWE-295

TI-2023-15380 CVE-2023-32076 · GHSA-wc64-c5rv-32pf

LOW 24

in-toto is a framework to protect supply chain integrity.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00243 Published 2023-05-10 Fixed in 2.0.0 CWE-15

TI-2021-17929 CVE-2021-41087 · GHSA-vrxp-mg9f-hwf3

LOW 29

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0043 Published 2021-09-21 Fixed in 0.3.0 CWE-345