Skip to content
Sigstore vulnerabilities
Newest
-
sigstore sigstore-js
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
CVE-2026-118763
Fix available
7.4 High
-
sigstore sigstore-go
sigstore-go fails to check signature timestamps against a signing key's validity period
CVE-2026-54787
Fix available
3.1 Low
-
sigstore sigstore-js
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
CVE-2026-59891
Public exploitFix available
9.6 Critical
-
sigstore sigstore-go
sigstore-go: Multi-log threshold bypass via single compromised log
CVE-2026-49834
Fix available
5.9 Medium
-
sigstore sigstore-js
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
CVE-2026-48815
Fix available
7.5 High
-
sigstore sigstore-js
sigstore-js: Insufficient Verification of Data Authenticity
CVE-2026-48816
Fix available
6.5 Medium
-
linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 more
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
CVE-2026-49835
Fix available
5.9 Medium
-
sigstore fulcio
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
CVE-2026-49478
Fix available
8.7 High
-
sigstore sigstore-java
Sigstore Java has a vulnerability with bundle verification of integratedTime
CVE-2026-48791
Fix available
2.0 Low
-
sigstore sigstore-js
sigstore-js: DSSE payloadType type-binding failure
CVE-2026-48758
Fix available
5.4 Medium
-
sigstore rekor
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
CVE-2026-48702
Fix available
7.5 High
-
sigstore gitsign
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44309
Fix available
5.3 Medium
-
sigstore gitsign
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2026-44310
Fix available
5.4 Medium
-
linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 more
Sigstore Timestamp Authority has Improper Certificate Validation in verifier
CVE-2026-39984
Fix available
5.5 Medium
-
sigstore cosign
Cosign's verify-blob-attestation reports false positive when payload parsing fails
CVE-2026-39395
Fix available
4.3 Medium
-
sigstore, sigstore sigstore-ruby +1 more
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
CVE-2026-31830
Fix available
7.5 High
-
sigstore cosign
Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
CVE-2026-24122
Fix available
3.7 Low
-
linuxfoundation sigstore-python
sigstore has CSRF possibility in OIDC authentication during signing
CVE-2026-24408
Fix available
0.0 None
-
sigstore
sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
CVE-2026-24137
Fix available
5.8 Medium
-
linuxfoundation rekor
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
CVE-2026-24117
Fix available
5.3 Medium
-
linuxfoundation rekor
Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message
CVE-2026-23831
Fix available
5.3 Medium
-
linuxfoundation fulcio
Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
CVE-2026-22772
Fix available
5.8 Medium
-
sigstore cosign
Cosign verification accepts any valid Rekor entry under certain conditions
CVE-2026-22703
Fix available
5.5 Medium
-
linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 more
Sigstore Timestamp Authority allocates excessive memory during request parsing
CVE-2025-66564
Fix available
7.5 High
-
linuxfoundation fulcio
Fulcio allocates excessive memory during token parsing
CVE-2025-66506
Fix available
7.5 High
-
sigstore sigstore-python
sigstore-python has insufficient validation of integration timestamp during verification
CVE-2024-55655
Fix available
2.7 Low
-
sigstore sigstore-java
sigstore-java has a vulnerability with bundle verification
CVE-2024-54140
Fix available
2.1 Low
-
sigstore sigstore-java
Vulnerability with bundle verification in sigstore-java
CVE-2024-53267
Fix available
5.5 Medium
-
sigstore gitsign
Use of incorrect Rekor entries during verification in gitsign
CVE-2024-51746
Fix available
1.8 Low
-
sigstore sigstore-go
Unbounded loop over untrusted input can lead to endless data attack
CVE-2024-45395
Fix available
3.1 Low
-
sigstore cosign
Cosign vulnerable to machine-wide denial of service via malicious artifacts
CVE-2024-29903
Fix available
4.2 Medium
-
sigstore cosign
Cosign vulnerable to system-wide denial of service via malicious attachments
CVE-2024-29902
Fix available
4.2 Medium
-
sigstore gitsign
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
CVE-2023-47122
Fix available
4.2 Medium
-
sigstore cosign
Possible endless data attack from attacker-controlled registry in cosign
CVE-2023-46737
Fix available
3.1 Low
-
linuxfoundation rekor
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
CVE-2023-33199
Fix available
5.3 Medium
-
linuxfoundation rekor
Rekor's compressed archives can result in OOM conditions
CVE-2023-30551
Fix available
7.5 High
-
sigstore cosign
Vulnerabilities with blob verification in sigstore cosign
CVE-2022-36056
Fix available
5.5 Medium
-
sigstore policy-controller, policy controller +1 more
Ability to bypass attestation verification in sigstore PolicyController
CVE-2022-35930
Fix available
7.1 High
-
sigstore cosign
False positive signature verification in cosign
CVE-2022-35929
Fix available
7.1 High
-
sigstore cosign
Improper Certificate Validation in Cosign
CVE-2022-23649
Fix available
3.3 Low