Vulnerabilities

TI-2026-82694 CVE-2026-118763 · GHSA-j63v-mwhm-56jx

@sigstore/oci leaks registry credentials to cross-host upload URLs

LOW 32

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.003 Published 2026-10-29 Fixed in 0.7.2 CWE-522

TI-2026-35984 CVE-2026-48702 · GHSA-47q9-m4ww-924m

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

LOW 39

Rekor is a software supply chain transparency log.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-08-13 Partial fix · 1.5.2 CWE-770

TI-2026-36632 CVE-2026-49478 · GHSA-f5mr-q85p-6hh6

Server-side request forgery in sigstore fulcio

LOW 39

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00282 Published 2026-08-13 Partial fix · 1.8.6 CWE-918

TI-2026-36061 CVE-2026-48791 · GHSA-qqw8-7c2r-jxch

Sigstore Java has a vulnerability with bundle verification of integratedTime

MEDIUM 44

sigstore-java is a sigstore java client for interacting with sigstore infrastructure.

CVSS 3.1LOW 2.0 Local High privileges User interaction EPSS 0.00071 Published 2026-08-12 Fixed in 2.1.0 CWE-347

TI-2026-39593 CVE-2026-54787 · GHSA-wqqc-jjcq-vfxm

sigstore-go fails to check signature timestamps against a signing key's validity period

LOW 14

sigstore-go is a Go library for Sigstore signing and verification.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00134 Published 2026-07-31 Fixed in 1.2.1 CWE-324

TI-2026-36738 CVE-2026-49834 · GHSA-9vcr-p3rj-q5q6

sigstore-go: Multi-log threshold bypass via single compromised log

LOW 32

sigstore-go is a Go library for Sigstore signing and verification.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00181 Published 2026-07-17 Partial fix · 1.2.0 CWE-347

TI-2026-36739 CVE-2026-49835 · GHSA-9c54-x2g4-v92j

Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

LOW 34

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00744 Published 2026-07-17 Fixed in 2.1.0 CWE-770

TI-2026-36085 CVE-2026-48816 · GHSA-xgjw-pm74-86q4

sigstore-js: Insufficient Verification of Data Authenticity

MEDIUM 62

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00144 Published 2026-07-14 Partial fix · 3.1.1 CWE-345

TI-2026-36028 CVE-2026-48758 · GHSA-jfc7-64v2-mr8c

sigstore-js: DSSE payloadType type-binding failure

MEDIUM 58

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00239 Published 2026-07-14 Partial fix · 3.2.1 CWE-347

TI-2026-36084 CVE-2026-48815 · GHSA-52v5-jr5w-gjxr

sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

HIGH 72

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00173 Published 2026-07-14 Partial fix · 4.1.1 CWE-347

TI-2026-42705 CVE-2026-59891 · GHSA-pf56-329r-95rw

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

MEDIUM 43

sigstore-js provides JavaScript libraries for interacting with Sigstore services.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00473 Published 2026-07-14 Fixed in 0.7.1 CWE-522

TI-2026-32277 CVE-2026-44309 · GHSA-7rmh-48mx-2vwc

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

MEDIUM 57

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.0014 Published 2026-05-15 Partial fix · 0.16.0 CWE-295

TI-2026-32278 CVE-2026-44310 · GHSA-7c37-gx6w-8vc5

gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

MEDIUM 58

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00131 Published 2026-05-15 Partial fix · 0.15.0 CWE-129

TI-2026-28838 CVE-2026-39984 · GHSA-xm5m-wgh2-rrg3

Sigstore Timestamp Authority has Improper Certificate Validation in verifier

LOW 24

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00099 Published 2026-04-14 Partial fix · 2.0.6 CWE-295

TI-2026-28380 CVE-2026-39395 · GHSA-w6c6-c85g-mmv6

Cosign's verify-blob-attestation reports false positive when payload parsing fails

LOW 24

Cosign provides code signing and transparency for containers and binaries.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0025 Published 2026-04-07 Partial fix · 3.0.6, 2.6.3 CWE-754

TI-2026-24383 CVE-2026-31830 · GHSA-mhg6-2q2v-9h2c

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

LOW 39

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00278 Published 2026-03-10 Fixed in 0.2.3 CWE-252

TI-2026-19440 CVE-2026-24122 · GHSA-wfqv-66vq-46rm

Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

LOW 17

Cosign provides code signing and transparency for containers and binaries.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00215 Published 2026-02-19 Fixed in 3.0.5 CWE-295

TI-2026-19675 CVE-2026-24408 · GHSA-hm8f-75xx-w2vr

sigstore has CSRF possibility in OIDC authentication during signing

LOW 22

sigstore-python is a Python tool for generating and verifying Sigstore signatures.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00178 Published 2026-01-26 Fixed in 4.2.0 CWE-352

TI-2026-19455 CVE-2026-24137 · GHSA-fcv2-xgw5-pqxf

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

LOW 26

sigstore framework is a common go library shared across sigstore services and clients.

CVSS 3.1MEDIUM 5.8 Network High privileges No interaction EPSS 0.0039 Published 2026-01-23 Partial fix · 1.10.4 CWE-22

TI-2026-19437 CVE-2026-24117 · GHSA-4c4x-jm2x-pf9j

Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

LOW 30

Rekor is a software supply chain transparency log.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00363 Published 2026-01-22 Partial fix · 1.5.0 CWE-918

TI-2026-19196 CVE-2026-23831 · GHSA-273p-m2cw-6833

Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message

LOW 30

Rekor is a software supply chain transparency log.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00426 Published 2026-01-22 Partial fix · 1.5.0 CWE-476

TI-2026-18290 CVE-2026-22772 · GHSA-59jp-pj84-45mr

Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

HIGH 65

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00232 Published 2026-01-12 Partial fix · 1.8.5 CWE-918

TI-2026-18230 CVE-2026-22703 · GHSA-whqx-f9j3-ch6m

Cosign verification accepts any valid Rekor entry under certain conditions

LOW 24

Cosign provides code signing and transparency for containers and binaries.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00106 Published 2026-01-10 Partial fix · 3.0.4, 2.6.2 CWE-345

TI-2025-40975 CVE-2025-66564 · GHSA-4qg8-fj49-pxjh

Sigstore Timestamp Authority allocates excessive memory during request parsing

LOW 39

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2025-12-04 Partial fix · 2.0.3 CWE-405

TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw

Fulcio allocates excessive memory during token parsing

LOW 38

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00226 Published 2025-12-04 Partial fix · 1.8.3 CWE-405

Vulnerabilities

Filters