SI
Vendor
sigstore
34
CVEs
0
On KEV
0
New 30D
Products
CO9.8
cosign
sigstore
9 CVEs0 on KEV0 new
SI9.6
sigstore-js
sigstore
4 CVEs0 on KEV0 new
FU8.7
fulcio
sigstore
3 CVEs0 on KEV0 new
GI5.4
gitsign
sigstore
3 CVEs0 on KEV0 new
RE7.5
rekor
sigstore
3 CVEs0 on KEV0 new
SI7.5
sigstore-go
sigstore
3 CVEs0 on KEV0 new
TI7.5
timestamp-authority
sigstore
3 CVEs0 on KEV0 new
SI7.5
sigstore
sigstore
2 CVEs0 on KEV0 new
PO8.8
policy-controller
sigstore
1 CVEs0 on KEV0 new
SI2.0
sigstore-java
sigstore
1 CVEs0 on KEV0 new
SI5.0
sigstore-python
sigstore
1 CVEs0 on KEV0 new
SI7.5
sigstore-ruby
sigstore
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-48702 | RE rekor sigstore | 7.5 | Aug 13 | Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic |
| CVE-2026-49478 | FU fulcio sigstore | 8.7 | Aug 13 | Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage |
| CVE-2026-48791 | SI sigstore-java sigstore | 2.0 | Aug 12 | Sigstore Java has a vulnerability with bundle verification of integratedTime |
| CVE-2026-54787 | SI sigstore-go sigstore | 3.1 | Jul 31 | sigstore-go fails to check signature timestamps against a signing key's validity period |
| CVE-2026-49834 | SI sigstore-go sigstore | 7.5 | Jul 17 | sigstore-go: Multi-log threshold bypass via single compromised log |
| CVE-2026-49835 | TI timestamp-authority sigstore | 7.5 | Jul 17 | Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality |
| CVE-2026-48816 | SI sigstore-js sigstore | 6.5 | Jul 14 | sigstore-js: Insufficient Verification of Data Authenticity |
| CVE-2026-48758 | SI sigstore-js sigstore | 5.4 | Jul 14 | sigstore-js: DSSE payloadType type-binding failure |
| CVE-2026-48815 | SI sigstore-js sigstore | 7.5 | Jul 14 | sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced |
| CVE-2026-59891 | SI sigstore-js sigstore | 9.6 | Jul 14 | Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry |
| CVE-2026-44309 | GI gitsign sigstore | 5.3 | May 15 | gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits |
| CVE-2026-44310 | GI gitsign sigstore | 5.4 | May 15 | gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers |
| CVE-2026-39984 | TI timestamp-authority sigstore | 5.5 | Apr 14 | Sigstore Timestamp Authority has Improper Certificate Validation in verifier |
| CVE-2026-39395 | CO cosign sigstore | 5.3 | Apr 7 | Cosign's verify-blob-attestation reports false positive when payload parsing fails |
| CVE-2026-31830 | SI sigstore-ruby sigstore | 7.5 | Mar 10 | sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest |
| CVE-2026-24122 | CO cosign sigstore | 3.7 | Feb 19 | Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked |
| CVE-2026-24408 | SI sigstore-python sigstore | 5.0 | Jan 26 | sigstore has CSRF possibility in OIDC authentication during signing |
| CVE-2026-24137 | SI sigstore sigstore | 5.8 | Jan 23 | sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal |
| CVE-2026-24117 | RE rekor sigstore | 5.3 | Jan 22 | Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL |
| CVE-2026-23831 | RE rekor sigstore | 5.3 | Jan 22 | Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message |
| CVE-2026-22772 | FU fulcio sigstore | 5.3 | Jan 12 | Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass |
| CVE-2026-22703 | CO cosign sigstore | 5.5 | Jan 10 | Cosign verification accepts any valid Rekor entry under certain conditions |
| CVE-2025-66564 | TI timestamp-authority sigstore | 7.5 | Dec 4 | Sigstore Timestamp Authority allocates excessive memory during request parsing |
| CVE-2025-66506 | FU fulcio sigstore | 7.5 | Dec 4 | Fulcio allocates excessive memory during token parsing |
| CVE-2024-45395 | SI sigstore-go sigstore | 7.5 | Sep 4 | Unbounded loop over untrusted input can lead to endless data attack |
| CVE-2024-29903 | CO Cosign Sigstore | 7.5 | Apr 10 | Cosign provides code signing and transparency for containers and binaries |
| CVE-2024-29902 | CO Cosign Sigstore | 5.9 | Apr 10 | Cosign provides code signing and transparency for containers and binaries |
| CVE-2023-47122 | GI Gitsign Sigstore | 5.3 | Nov 10 | Gitsign is software for keyless Git signing using Sigstore |
| CVE-2023-46737 | CO Cosign Sigstore | 5.3 | Nov 7 | Cosign is a sigstore signing tool for OCI containers |
| CVE-2022-36056 | CO Cosign Sigstore | 5.5 | Sep 14 | Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure |
| CVE-2022-35930 | PO policy-controller sigstore | 8.8 | Aug 4 | Ability to bypass attestation verification in sigstore PolicyController |
| CVE-2022-35929 | CO cosign sigstore | 9.8 | Aug 4 | False positive signature verification in cosign |
| CVE-2022-23649 | CO Cosign Sigstore | 3.3 | Feb 18 | Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project |