GO-2025-3485 vulnerabilities

Vulnerabilities for packages: kargo, fulcio, spiffe-helper, sftpgo, undock, skaffold, gomplate, vault-benchmark, hydra, melange, temporal-ui-server, step-issuer, kyverno-policy-reporter, guac, k3d, splunk-otel-collector, goreleaser, sftpgo-plugin-kms, zarf, apko, opentofu, gitsign, bank-vaults,...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: chartmuseum, sftpgo-plugin-auth, wire-go, logstash, kuberlr, local-static-provisioner, kargo, redka, crossplane-provider-keycloak, seaweedfs, kpt, kube-metrics-adapter, src-fingerprint, crossplane-provider-aws-cloudformation, gomplate, libnvidia-container,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: chartmuseum, sftpgo-plugin-auth, kube-logging-operator, fuse-overlayfs-snapshotter, kuberlr, local-static-provisioner, kargo, crossplane-provider-keycloak, seaweedfs, kpt, kube-metrics-adapter, src-fingerprint, crossplane-provider-aws-cloudformation, gomplate,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, kube-logging-operator, fuse-overlayfs-snapshotter, local-static-provisioner, kargo, redka, seaweedfs, kpt, kube-metrics-adapter, src-fingerprint, crossplane-provider-aws-cloudformation, gomplate, libnvidia-container,...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, kube-logging-operator, fuse-overlayfs-snapshotter, local-static-provisioner, kargo, redka, kpt, src-fingerprint, gomplate, libnvidia-container, kubernetes-event-exporter, extism, velero, nri-kubernetes, gitness, kubevela,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: spire-server, crossplane-provider-azure-sql, glab, policy-controller, crossplane-provider-azure-managedidentity, opentelemetry-collector-contrib, crossplane-provider-azure-storage, pulumi-kubernetes-operator, ksops, nuclei, kargo, falcoctl, fulcio,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, kube-logging-operator, fuse-overlayfs-snapshotter, kargo, kpt, src-fingerprint, crossplane-provider-aws-cloudformation, gomplate, crossplane-provider-aws-dynamodb, kubernetes-event-exporter, velero, melange, nri-kubernetes, gitness, kubevela,...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Linux Distros Unpatched Vulnerability : CVE-2026-48791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor ent...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-49834

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

ROOT-APP-NPM-CVE-2026-48816 CVE-2026-48816 in @sigstore/verify - Patched by Root

Root has patched CVE-2026-48816 in the @sigstore/verify package for Root:npm. Multiple fixed versions available...

CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

UBUNTU-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.321 Vulnerability Details CVEID:CVE-2026-48815 DESCRIPTION: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...