GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:3666-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3666-1 advisory. This update for cosign rebuilds it against the current go security release. Tenable has extracted the preceding...

Security update for cosign

This update for cosign rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...

SUSE-SU-2026:3666-1 Security update for cosign

This update for cosign rebuilds it against the current go security release...

PT-2026-83765

This update for cosign rebuilds it against the current go security release...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: controller-gen, gitness, aws-otel-collector, gatekeeper, cluster-proportional-autoscaler, k3d, nri-nginx, bazelisk, malcontent, timoni, rancher-system-upgrade-controller, flyte, step-kms-plugin, cluster-api-ipam-provider-in-cluster, buildkitd, harbor-scanner-trivy,...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: controller-gen, gitness, aws-otel-collector, gatekeeper, cluster-proportional-autoscaler, k3d, nri-nginx, bazelisk, malcontent, timoni, rancher-system-upgrade-controller, flyte, step-kms-plugin, cluster-api-ipam-provider-in-cluster, buildkitd, yunikorn-web,...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: weaviate, kubernetes-csi-node-driver-registrar, crossplane-provider-sql, github-mcp-server, gitness, kubernetes-replicator, openbao, spegel, syft, sftpgo, cluster-proportional-autoscaler, timoni, argo-rollouts, k8s-device-plugin, infinispan-operator, cass-operator,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: gh, cosign, slsa-verifier, cosign-fips...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: tekton-chains, falcoctl-fips, cosign-fips, kubescape, vexctl, falcoctl, gitsign...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: tfsec, k8sgpt, conftest, cosign-fips, policy-controller, zarf, cosign, spire-server, spire-server-fips, policy-controller-fips, snyk-cli, kubescape, kots, opa, zot, conftest-fips...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: tekton-chains, external-secrets-fips, falcoctl-fips, cosign-fips, mc, spire-server, spire-server-fips, kubescape, boring-registry, vexctl, falcoctl, minio, gitsign...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, opentelemetry-collector-contrib-fips, amazon-cloudwatch-agent-fips, conftest, nri-prometheus, policy-controller, grype-fips, kube-bench-fips, nri-discovery-kubernetes, conftest-fips, amazon-cloudwatch-agent-operator, glab, openfga-fips,...

GO-2024-2512 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, k3d, chartmuseum, cadvisor, policy-controller, buildkitd, zarf, skaffold, policy-controller-fips, loki, guac, nerdctl, crane, aactl, flux, timoni, k8sgpt, cosign, cri-tools, docker-credential-gcr, kargo, ko-fips, pulumi, helm-operator-fips,...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, policy-controller, terragrunt, melange, goreleaser, fulcio, skaffold, gomplate, aactl, temporal, temporal-fips, minio-fips, step, temporal-ui-server, dgraph, kubescape, caddy-fips, wolfictl, temporal-ui-server-fips, slsa-verifier,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: k3d, memcached-exporter, nri-prometheus, git-lfs, mc, wavefront-collector-for-kubernetes, kiam, skaffold, gomplate, gobuster, kubewatch, hey, aactl, timoni, pulumi-kubernetes-operator, secrets-store-csi-driver-provider-gcp, kube-logging-logging-operator,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, tekton-chains, ko, falcoctl-fips, policy-controller, melange, cosign, slsa-verifier, tkn, spire-server, skaffold, spire-server-fips, apko, kubescape, flux-source-controller...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: policy-controller, fulcio, teleport-operator-fips, skaffold, aactl, kyverno-notation-aws, crossplane-fips, vexctl, flux-source-controller-fips, neuvector-sigstore-interface-fips, xeol, kubescape, tkn-fips, prometheus-podman-exporter-fips, slsa-verifier,...

GO-2026-4355 vulnerabilities

Vulnerabilities for packages: witness, policy-controller, ratify, buildkitd, gh, zarf, ratify-fips, kyverno-policy-reporter-plugins-kyverno-fips, skaffold, policy-controller-fips, buildkitd-fips, cg, aactl, image-factory-fips, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, cosign,...