OPENSUSE-SU-2026:21481-1 Security update for vexctl

This update for vexctl fixes the following issues: - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto bsc1234486. - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in...

CLEANSTART-2026-VX21477 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-23831, CVE-2026-23991, CVE-2026-23992, CVE-2026-24051, CVE-2026-24137, CVE-2026-25679, CVE-2026-26958, CVE-2026-27142, CVE-2026-33186, CVE-2026-33211, ghsa-273p-m2cw-6833, ghsa-4c4x-jm2x-pf9j, ghsa-4qg8-fj49-pxjh, ghsa-846p-jg2w-w324, ghsa-f83f-xpx7-ffpw, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4, ghsa-mqqf-5wvp-8fh8 applied in versions: 0.43.0-r0, 0.43.0-r1, 0.43.0-r2, 0.43.0-r3, 0.43.0-r4

Multiple security vulnerabilities affect the tkn-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DU60388 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-23831, CVE-2026-23991, CVE-2026-23992, CVE-2026-24051, CVE-2026-24137, CVE-2026-25679, CVE-2026-26958, CVE-2026-27142, CVE-2026-33186, CVE-2026-33211, ghsa-273p-m2cw-6833, ghsa-4c4x-jm2x-pf9j, ghsa-4qg8-fj49-pxjh, ghsa-846p-jg2w-w324, ghsa-f83f-xpx7-ffpw, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4, ghsa-mqqf-5wvp-8fh8 applied in versions: 0.43.0-r0, 0.43.0-r1, 0.43.0-r2, 0.43.0-r3, 0.43.0-r4

Multiple security vulnerabilities affect the tkn-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Security update for cosign

This update for cosign fixes the following issues: Update to version 3.0.5 jscSLE-23879. Security issues fixed: CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs bsc1250620. CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause...

cosign-3.0.5-1.1 on GA media (moderate)

cosign-3.0.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:10235-1 Rating: moderate Cross-References: CVE-2026-22772 CVE-2026-23991 CVE-2026-23992 CVE-2026-24122 CVE-2026-24137 CVE-2026-26958 CVSS scores: CVE-2026-22772 SUSE : 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVE-2026-22772 SU...

SUSE-SU-2026:0592-1 Security update for vexctl

This update for vexctl fixes the following issues: - Update to version 0.4.1+git78.f951e3a: - CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2. bsc1239186 - CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in...

SUSE CVE-2026-24137

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from...

CVE-2026-24137

creationtimestamp| type| source ---|---|--- 2026-01-23 03:04:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md2poy464o23 2026-01-24 21:22:42+00:00| seen| https://gist.github.com/alon710/bcce36cb7d3ca802621bc6d8b450a705 2026-01-24 22:17:57+00:00| seen|...