GO-2025-4155 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, rancher-helm, haproxy-ingress, nri-haproxy, metrics-agent, crossplane-provider-keycloak, gitea, jaeger-operator, helm-mapkubeapis, newrelic-infra-operator, tailscale, knative-client, nri-apache, sealed-secrets, pulumi-kubernetes-operator,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, eksctl, rancher-helm, weaviate, caddy, gitea, jaeger-operator, helm-mapkubeapis, newrelic-infra-operator, fscrypt, aws-flb-firehose, kubernetes-dashboard-metrics-scraper, falcosidekick, victoriametrics-operator, argocd-image-updater,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kube-bench, cloud-sql-proxy, eksctl, nri-haproxy, envconsul, caddy, cloud-provider-vsphere, opa, grafana-alloy, kubecolor, dive, kuberlr, chart-testing, buildkitd, zot, prometheus, nodetaint, cluster-api-helm-controller, nri-apache, k8sgateway, cilium-cli, harbor-cli...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: kube-bench, eksctl, haproxy-ingress, weaviate, crossplane-provider-keycloak, jaeger-operator, newrelic-infra-operator, tailscale, knative-client, chezmoi, pulumi-kubernetes-operator, kubernetes-dashboard-metrics-scraper, falcosidekick, victoriametrics-operator,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: gitsign, azcopy, eksctl, flux-source-controller, weaviate, glab, grafana-alloy, gitea, flux-notification-controller, actions-runner-controller, velero, crossplane-provider-azure-storage, buildkitd, crossplane-provider-azure-authorization,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: policy-controller, spire-server, gh, gitsign, flux-source-controller, tekton-chains, tkn, apko, slsa-verifier, melange, trivy, wolfictl, zot, sigstore-scaffolding, cosign, falcoctl, zarf, aactl, neuvector-sigstore-interface, rekor, vexctl, kubescape...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, eksctl, haproxy-ingress, nri-haproxy, weaviate, caddy, gitea, fscrypt, aws-flb-firehose, tailscale, chezmoi, nri-apache, pulumi-kubernetes-operator, kubernetes-dashboard-metrics-scraper, falcosidekick, nri-elasticsearch, victoriametrics-operato...

GO-2025-3485 vulnerabilities

Vulnerabilities for packages: gitsign, flux-source-controller, weaviate, caddy, grpc-health-probe, grafana-alloy, apko, melange, zot, sigstore-scaffolding, argo-workflows, goreleaser, step-ca, argocd-image-updater, distribution, aactl, bank-vaults, kyverno-notation-aws, vexctl, trufflehog, traefi...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, haproxy-ingress, nri-haproxy, weaviate, caddy, newrelic-infra-operator, aws-flb-firehose, tailscale, chezmoi, nri-apache, pulumi-kubernetes-operator, kubernetes-dashboard-metrics-scraper, falcosidekick, nri-elasticsearch,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, eksctl, haproxy-ingress, weaviate, caddy, crossplane-provider-keycloak, gitea, jaeger-operator, newrelic-infra-operator, tailscale, chezmoi, pulumi-kubernetes-operator, kubernetes-dashboard-metrics-scraper, falcosidekick,...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, eksctl, haproxy-ingress, nri-haproxy, weaviate, caddy, crossplane-provider-keycloak, jaeger-operator, fscrypt, aws-flb-firehose, tailscale, knative-client, chezmoi, nri-apache, kubernetes-dashboard-metrics-scraper, falcosidekick,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: policy-controller, spire-server, gh, gitsign, kubevela, flux-source-controller, tekton-chains, scorecard, crossplane-provider-azure-sql, terragrunt, tkn, k3s, nuclei, src-fingerprint, glab, opentelemetry-collector-contrib, skopeo, flux-notification-controller,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: kube-bench, nri-kafka, eksctl, haproxy-ingress, nri-haproxy, caddy, newrelic-infra-operator, aws-flb-firehose, tailscale, chezmoi, nri-apache, pulumi-kubernetes-operator, kubernetes-dashboard-metrics-scraper, falcosidekick, nri-elasticsearch,...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Linux Distros Unpatched Vulnerability : CVE-2026-48791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor ent...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...