PT-2026-39243

Name of the Vulnerable Software and Affected Versions Gitsign versions prior to 0.16.0 Description gitsign verify and gitsign verify-tag re-encode commit or tag objects using the EncodeWithoutSignature function from the go-git library before checking the signature, rather than verifying the raw g...

CVE-2026-44309

creationtimestamp| type| source ---|---|--- 2026-05-06 16:05:09+00:00| published-proof-of-concept| https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc...

CVE-2026-44310

creationtimestamp| type| source ---|---|--- 2026-05-04 16:54:58+00:00| published-proof-of-concept| https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, crossplane, skaffold, zot, gitsign, gh, trivy, policy-controller, teleport, aactl, spire-server, kubescape, slsa-verifier, falcoctl, trivy-operator, witness, tflint, flux-source-controller, docker, vexctl, docker-cli-buildx, zarf, kyvern...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, crossplane, skaffold, zot, gitsign, gh, trivy, policy-controller, teleport, aactl, spire-server, kubescape, slsa-verifier, falcoctl, trivy-operator, witness, tflint, flux-source-controller, docker, vexctl, docker-cli-buildx, zarf, kyvern...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: datadog-agent, litestream, k3s, db-operator, cert-manager-csi-driver, cluster-api-provider-vsphere, argo-events, dkron, policy-controller, cadvisor, crossplane-provider-sql, task, crossplane-provider-azure-managedidentity, gitlab-kas, step-kms-plugin,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: mattermost, telegraf, mariadb-operator, sftpgo, amass, gitsign, kots, caddy, flux-kustomize-controller, nuclei, rekor, terragrunt, keda, wolfictl, k3s, db-operator, sftpgo-plugin-eventstore, croc, step-ca, jitsucom-bulker, dbmate, crossplane-provider-sql, ksops,...

EUVD-2023-3067

Malicious code in bioql PyPI...

EUVD-2024-3224

Malicious code in bioql PyPI...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, nats, gitsign, secrets-store-csi-driver-provider-aws, lvm-driver, shfmt, linkerd2-proxy-init, mongodb-kubernetes-operator, rancher-machine, ctop, newrelic-fluent-bit-output, grafana-operator, vault-k8s, octo-sts, newrelic-nri-statsd,...

CVE-2023-47122

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

Incorrect Rekor Entry Selection

github.com/sigstore/gitsign is vulnerable to Incorrect Rekor entry selection. The vulnerability is due to gitsign not correctly handling situations where multiple Rekor entries are returned during online verification, leading it to potentially select the wrong one. It allows an attacker to...

SUSE CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746

CVE-2024-51746 affects gitsign. The vulnerability arises when Rekor’s search API is used to verify a signature: the API may return entries that match either the public key or the payload, not both. As a result, gitsign could select an incorrect Rekor entry during online verification, and, because...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...