minimal

137 small, hardened container images. Free, MIT-licensed, signed, and rebuilt daily. Browse the catalog → Quick start docker pull ghcr.io/rtvkiz/minimal-python:latest No account needed. Every image has a :latest-dev companion with a shell and toolchain for debugging and multi-stage builds. docker...

tfsec

📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...

kit

kit Tool registry manager -- manages developer toolchains from git-based registries, layered on top of mise. What it is kit resolves tool versions across multiple registries, generates mise configuration, verifies SHA-256 checksums against publisher release artifacts, verifies cosign signatures...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cosign: cosign-3.1.3-0.3.hum1 aarch64, s390x, x8664 cosign-3.1.3-0.3.hum1.src src...

cosign

cosign Firma di container OCI e altri artefatti utilizzando Sigstore! Cosign mira a rendere le firme infrastruttura invisibile. Cosign supporta: "Firma senza chiave" con l'autorità di certificazione Fulcio del bene pubblico Sigstore e il registro di trasparenza Rekor predefinito Firma hardware e...

PT-2026-110167

🚨 CVE-2026-108699 hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign verify args accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sig...

CLEANSTART-2026-AI33575 Security fix for ghsa-9h8m-3fm2-qjrq applied in: cosign 3.0.5-r0

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZL19560 Security fix for GHSA-9h8m-3fm2-qjrq applied in: consul 1.21.5-r0

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KC38093 Security fix for GHSA-9h8m-3fm2-qjrq applied in: kube-state-metrics-fips 2.18.0-r2

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WS51251 Security fix for GHSA-9h8m-3fm2-qjrq applied in: buildkitd 0.26.3-r1, containerd 2.1.3-r2, cosign 3.0.5-r0

GHSA-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UX86931 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-NV69611 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-QN15413 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the cosign package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-TD47078 Security fix for GHSA-78h2-9frx-2jm8 applied in: cosign 3.0.5-r0

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MX88570 Security fix for GHSA-p77j-4mvh-x3m3 applied in: cosign 3.0.5-r0

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:4392-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4392-1 advisory. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272117. -...

Security update for cosign

This update for cosign fixes the following issues: CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272117. CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library...

SUSE-SU-2026:4392-1 Security update for cosign

This update for cosign fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272117. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library...

OPENSUSE-SU-2026:11871-1 cosign-3.1.3-1.1 on GA media

These are all security issues fixed in the cosign-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20260921-73-0124

The vulnerability of the Cosign digital signature tool, which stems from improper verification of the certificate, allows a perpetrator to bypass verifications of identification data and the binding to the OIDC issuer...