minimal

151 small, hardened container images. Free, MIT-licensed, signed, and rebuilt daily. Browse the catalog → Quick start docker pull ghcr.io/rtvkiz/minimal-python:latest No account needed. Every image has a :latest-dev companion with a shell and toolchain for debugging and multi-stage builds. docker...

tfsec

📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...

Sigstore Cosign Bypass Security Restrictions

The vulnerability in the cosign verify-blob and cosign verify-blob-attestation commands of the Sigstore Cosign digital signature tool is related to errors in the certificate verification process, allowing a remote attacker to bypass security restrictions...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22201-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22201-1 advisory. Changes in hauler: - update vendor: CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in ClientIPFromXFF via X-Forwarded-For...

kit

kit Tool registry manager -- manages developer toolchains from git-based registries, layered on top of mise. What it is kit resolves tool versions across multiple registries, generates mise configuration, verifies SHA-256 checksums against publisher release artifacts, verifies cosign signatures...

CLEANSTART-2026-QR59684 Security fix for GHSA-xm5m-wgh2-rrg3 applied in: cosign-fips 2.6.3-r0, cosign-fips 3.0.6-r1

Security vulnerability affects the cosign-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TK91481 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign-fips package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-IQ57265 sigstore-go is a Go library for Sigstore signing and verification

Security vulnerability affects the cosign-fips package. sigstore-go is a Go library for Sigstore signing and verification...

CLEANSTART-2026-MN20743 Security fix for GHSA-pmwq-pjrm-6p5r applied in: cosign-fips 2.5.3-r1, cosign-fips 2.6.3-r2, cosign-fips 3.0.6-r2

Security vulnerability affects the cosign-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JP58072 Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project

Security vulnerability affects the cosign-fips package. Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project...

CLEANSTART-2026-HC28993 cosign is a container signing and verification utility

Security vulnerability affects the cosign-fips package. cosign is a container signing and verification utility...

CLEANSTART-2026-EV96739 Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure

Security vulnerability affects the cosign-fips package. Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure...

CLEANSTART-2026-VF84041 Cosign is a sigstore signing tool for OCI containers

Security vulnerability affects the cosign-fips package. Cosign is a sigstore signing tool for OCI containers...

CLEANSTART-2026-JJ11203 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign-fips package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-IK31949 Security fix for GHSA-hfvc-g4fc-pqhx applied in: cosign 2.6.4-r1, metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, trillian-fips 1.7.3-r1, kube-logging-operator 6.4.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, trillian 1.7.3-r1, gotenberg 8.30.1-r0, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

GHSA-hfvc-g4fc-pqhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UD96050 Security fix for GHSA-p436-gjf2-799p applied in: argo-workflows 3.6.19-r2, policy-controller 0.12.1-r1, cosign 2.6.4-r1, kubescape 3.0.47-r0, dynatrace-operator 1.6.3-r0, paranoia 0.5.0-r0

GHSA-p436-gjf2-799p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YW33351 Security fix for GHSA-pmwq-pjrm-6p5r applied in: cosign 2.6.4-r1

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZM38530 Security fix for GHSA-f5mr-q85p-6p5r applied in: cosign 2.6.4-r1

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DB81631 Security fix for GHSA-9vcr-p3rj-q5q6 applied in: cosign 2.6.4-r1

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PM74651 Security fix for GHSA-47q9-m4ww-924m applied in: cosign 2.6.4-r1

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...