cosign vulnerabilities (Debian)

3 vulnerabilities.

• cosign Debian Cosign's verify-blob-attestation reports false positive when payload parsing fails CVE-2026-39395 Fix available 4.3 MediumApril 7, 2026
• cosign Debian Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked CVE-2026-24122 Fix available 3.7 LowFebruary 19, 2026
• cosign Debian Cosign verification accepts any valid Rekor entry under certain conditions CVE-2026-22703 Fix available 5.5 MediumJanuary 10, 2026