sigstore

Top products

The 15 most recently published vulnerabilities affecting sigstore.

• CVE-2026-54787sigstore-go fails to check signature timestamps against a signing key's validity period3.1Jul 31, 2026
• CVE-2026-49834sigstore-go: Multi-log threshold bypass via single compromised log5.9Jul 17, 2026
• CVE-2026-49835Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality5.9Jul 17, 2026
• CVE-2026-48816sigstore-js: Insufficient Verification of Data Authenticity6.5Jul 14, 2026
• CVE-2026-48758sigstore-js: DSSE payloadType type-binding failure5.4Jul 14, 2026
• CVE-2026-48815sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced7.5Jul 14, 2026
• CVE-2026-59891Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry9.6Jul 14, 2026
• CVE-2026-44309gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits5.3May 15, 2026
• CVE-2026-44310gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers5.4May 15, 2026
• CVE-2026-39984Sigstore Timestamp Authority has Improper Certificate Validation in verifier5.5Apr 14, 2026
• CVE-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing fails4.3Apr 7, 2026
• CVE-2026-31830sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest7.5Mar 10, 2026
• CVE-2026-24122Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked3.7Feb 19, 2026
• CVE-2026-24137sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal5.8Jan 23, 2026
• CVE-2026-24117Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL5.3Jan 22, 2026