sigstore vulnerabilities (TuxCare)

2 vulnerabilities.

• sigstore TuxCare sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced CVE-2026-48815 Fix available 7.5 HighJuly 1, 2026
• sigstore TuxCare sigstore-js: DSSE payloadType type-binding failure CVE-2026-48758 Fix available 5.4 MediumJune 26, 2026