CVE-2026-6727: Observable Timing Discrepancy

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...

pypi-attestations (0.0.10) potentially affected by CVE-2026-24408 via sigstore (3.1.0)

sigstore PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestations 0.0.10 Source cves: CVE-2026-24408 Source advisory: OSV:PYSEC-2026-1924...

pypi-attestations (0.0.19) potentially affected by CVE-2026-24408 via sigstore (3.5.6)

sigstore PYPI version 3.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestations 0.0.19 Source cves: CVE-2026-24408 Source advisory: OSV:PYSEC-2026-1924...

pypi-attestation-models (>=0.0.2, <=0.0.5), pypi-attestations (>=0.0.6, <=0.0.9) potentially affected by CVE-2026-24408 via sigstore (3.0.0)

sigstore PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestation-models =0.0.2, =0.0.6, =0.0.9 Source cves: CVE-2026-24408 Source advisory: OSV:PYSEC-2026-1924...

projectair (1.1.0), pypi-attestation-models (>=0.0.1rc1, <=0.0.5) +2 more potentially affected by CVE-2024-55655 via sigstore (>=2.1.5, <=3.5.6)

sigstore PYPI version =2.1.5, =0.0.1rc1, =0.0.6, =0.1.0, =0.14.0 Source cves: CVE-2024-55655 Source advisory: OSV:PYSEC-2026-1923...

projectair (1.1.0), pypi-attestation-models (>=0.0.2, <=0.0.5) +3 more potentially affected by unknown CVE via tuf (5.1.0)

tuf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tuf and may be impacted: - projectair 1.1.0 - pypi-attestation-models =0.0.2, =0.0.6, =3.0.0, =0.34.0, =0.41.0 Source cves: unknown CVE Source advisory: OSV:GHSA-QP9X-WP8F-QGJJ...

CVE-2026-39395

A flaw was found in Cosign, a tool for code signing and transparency for containers and binaries. A remote attacker could exploit this vulnerability by providing malformed payloads or attestations with mismatched predicate types. This could lead to Cosign erroneously reporting a "Verified OK"...

CVE-2026-39395

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures,...

CVE-2026-39395 Cosign's verify-blob-attestation reports false positive when payload parsing fails

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures,...

PT-2026-31010

Name of the Vulnerable Software and Affected Versions Cosign versions prior to 3.0.6 and prior to 2.6.3 Description Cosign, a tool for code signing and transparency for containers and binaries, had a flaw in verify-blob-attestation where it could incorrectly report a successful verification...

EUVD-2026-10933

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

EUVD-2026-10932

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

pypi-attestation-models (>=0.0.2, <=0.0.5), pypi-attestations (>=0.0.6, <=0.0.9) potentially affected by CVE-2026-24408 via sigstore (3.0.0)

sigstore PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestation-models =0.0.2, =0.0.6, =0.0.9 Source cves: CVE-2026-24408 Source advisory: OSV:GHSA-HM8F-75XX-W2VR...

pypi-attestations (0.0.10) potentially affected by CVE-2026-24408 via sigstore (3.1.0)

sigstore PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestations 0.0.10 Source cves: CVE-2026-24408 Source advisory: OSV:GHSA-HM8F-75XX-W2VR...

pypi-attestations (0.0.19) potentially affected by CVE-2026-24408 via sigstore (3.5.6)

sigstore PYPI version 3.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - pypi-attestations 0.0.19 Source cves: CVE-2026-24408 Source advisory: OSV:GHSA-HM8F-75XX-W2VR...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...