fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

GHSA-2HW4-C9M4-F2FJ vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, traefik, tekton-pipelines-fips, tekton-pipelines, traefik-fips, kserve-fips, kserve-localmodelnode-agent, sigstore-scaffolding...

CVE-2026-118763 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while...

CVE-2026-118763

The sigstore-js library (specifically the @sigstore/oci package) is vulnerable to credential leakage in versions prior to 0.7.2 . The issue resides in packages/oci/src/registry.ts, where the RegistryClient.signIn() method stores registry Authorization and Docker configuration headers as defaults ...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

CLSA-2026-1793143332 TuxCare security update for @sigstore/sign (1 CVE)

TuxCare rebuilt @sigstore/sign to address 1 CVE. Fixed in 2.0.0-tuxcare.3...

trust-software-supply-chain-poc

Trusted Software Supply Chain — Proof of Concept This proof-...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 cosign verify-attestation --policy policy/text4shell.cue --type...

CLSA-2026-1792603628 TuxCare security update for @sigstore/core (1 CVE)

TuxCare rebuilt @sigstore/core to address 1 CVE. Fixed in 3.2.0-tuxcare.1...

CLSA-2026-1792582435 TuxCare security update for sigstore (1 CVE)

TuxCare rebuilt sigstore to address 1 CVE. Fixed in 1.9.0-tuxcare.1...

CLEANSTART-2026-CI36044 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48816 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-YO55047 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48815 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

CLEANSTART-2026-FS67325 sigstore-js provides JavaScript libraries for interacting with Sigstore services

CVE-2026-48758 affects multiple packages. sigstore-js provides JavaScript libraries for interacting with Sigstore services. See references for individual vulnerability details...

EUVD-2026-54222

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters...

CLEANSTART-2026-ZU97983 sigstore-js provides JavaScript libraries for interacting with Sigstore services

Security vulnerability affects the renovate package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

PT-2026-122875

Security vulnerability affects the renovate package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

CLSA-2026-1791840004 TuxCare security update for sigstore (1 CVE)

TuxCare rebuilt sigstore to address 1 CVE. Fixed in 2.3.1-tuxcare.1...

PT-2026-121714

TuxCare rebuilt sigstore to address 1 CVE. Fixed in 2.3.1-tuxcare.1...

CVE-2026-108699

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...