sigstore-go vulnerabilities (Debian)

2 vulnerabilities.

• sigstore-go Debian sigstore-go fails to check signature timestamps against a signing key's validity period CVE-2026-54787 Fix available 3.1 LowJuly 31, 2026
• sigstore-go Debian sigstore-go: Multi-log threshold bypass via single compromised log CVE-2026-49834 Fix available 5.9 MediumJuly 9, 2026