356 matches found
CVE-2026-22703
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...
CVE-2026-22703
Cosign prior to versions 2.6.2 and 3.0.4 could verify a Rekor entry without actually checking the artifact digest, signature, or public key, allowing a malicious actor to craft a valid bundle from any Rekor entry and evade audit. The issue affects Cosign’s signing/verification workflow and could ...
CVE-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...
Linux Distros Unpatched Vulnerability : CVE-2026-22703
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verif...
cosign 数据伪造问题漏洞
cosign is a container signing, verification and storage in an OCI registry in the United States. A data forgery issue vulnerability exists in Cosign versions prior to 2.6.2 and prior to 3.0.4, which stems from a specially crafted Cosign package being able to validate successfully even if the...
CVE-2022-23649
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...
PT-2026-2253
Name of the Vulnerable Software and Affected Versions Cosign versions prior to 2.6.2 and 3.0.4 Description Cosign is a tool providing code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, a crafted Cosign bundle could successfully verify an artifact even if...
WordPress CoSign Single Signon plugin <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] vulnerability
Reflected Cross-Site Scripting via $SERVER'PHPSELF' vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin CoSign Single Signon versions = 0.3.1...
CVE-2025-66564 vulnerabilities
Vulnerabilities for packages: cosign, kyverno, tekton-chains, kubescape, policy-controller, vexctl, zot, flux-source-controller, ko, crossplane, aactl, neuvector-sigstore-interface, sigstore-scaffolding, spire-server, zarf, skaffold, goreleaser, gitsign, falcoctl, teleport, witness, gh,...
GHSA-4QG8-FJ49-PXJH vulnerabilities
Vulnerabilities for packages: cosign, kyverno, tekton-chains, kubescape, policy-controller, vexctl, zot, flux-source-controller, ko, crossplane, aactl, neuvector-sigstore-interface, sigstore-scaffolding, spire-server, zarf, skaffold, goreleaser, gitsign, falcoctl, teleport, witness, gh,...
GHSA-4QG8-FJ49-PXJH vulnerabilities
Vulnerabilities for packages: cloudbeat-fips, image-factory, falcoctl-fips, goreleaser, sigstore-scaffolding, kubescape, kyverno-notation-aws, sigstore-scaffolding-fips, chainctl, policy-controller-fips, spire-server, falcoctl, skaffold-fips, ko-fips, cosign-fips, flux-source-controller-fips,...
CVE-2025-66564 vulnerabilities
Vulnerabilities for packages: cloudbeat-fips, image-factory, falcoctl-fips, goreleaser, sigstore-scaffolding, kubescape, kyverno-notation-aws, sigstore-scaffolding-fips, chainctl, policy-controller-fips, spire-server, falcoctl, skaffold-fips, ko-fips, cosign-fips, flux-source-controller-fips,...
CVE-2025-13512
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2025-13512
CVE-2025-13512 : CoSign Single Signon (WordPress plugin)
CVE-2025-13512 CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
PT-2025-49214
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ SERVER'PHP SELF' parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
WordPress plugin CoSign Single Signon 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...
EUVD-2007-2227
Malware in sbrugna...