GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, goreleaser, ko-fips, kubescape-server-fips, policy-controller, cloudbeat-fips, ko, crossplane, tbot, crossplane-fips, trivy-operator, cosign, policy-controller-fips, kyverno-notation-aws, trivy, trivy-operator-fips, kubescape, spire-server-fips,...

GHSA-59JP-PJ84-45MR vulnerabilities

Vulnerabilities for packages: witness, falcoctl, sigstore-scaffolding, kots, slsa-verifier, vexctl, falco-no-driver, cosign, tekton-chains, kubescape, aactl, zarf, gitsign, skopeo...

GHSA-4QG8-FJ49-PXJH vulnerabilities

Vulnerabilities for packages: zot, teleport, tekton-chains, spire-server, zarf, gitsign, falcoctl, tkn, flux-source-controller, kubescape, aactl, gh, kyverno-notation-aws, ko, kyverno, vexctl, docker-cli-buildx, crossplane, ratify, skaffold, goreleaser, witness, sigstore-scaffolding, cosign,...

cosign-2.5.0-1.1 on GA media (moderate)

cosign-2.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14988-1 Rating: moderate Cross-References: CVE-2024-51744 CVE-2024-6104 CVE-2025-22868 CVE-2025-22869 CVE-2025-22870 CVE-2025-27144 CVSS scores: CVE-2024-51744 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-51744 SUS...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...