GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: trivy, cloudbeat-fips, flux-source-controller, goreleaser, tekton-chains-fips, neuvector-sigstore-interface, crossplane, neuvector-sigstore-interface-fips, falcoctl, trivy-operator, jfrog-cli, kyverno-notation-aws, zarf-fips, kyverno-fips, aactl, kubescape,...

GHSA-59JP-PJ84-45MR vulnerabilities

Vulnerabilities for packages: vexctl, zarf, kots, skopeo, falco-no-driver, falcoctl, aactl, sigstore-scaffolding, witness, slsa-verifier, gitsign, tekton-chains, cosign, kubescape...

GHSA-4QG8-FJ49-PXJH vulnerabilities

Vulnerabilities for packages: goreleaser, skaffold, falcoctl, spire-server, policy-controller, witness, vexctl, aactl, zot, zarf, neuvector-sigstore-interface, ko, flux-source-controller, gitsign, tekton-chains, gh, docker-cli-buildx, tkn, tflint, teleport, ratify, sigstore-scaffolding,...

cosign-2.5.0-1.1 on GA media (moderate)

cosign-2.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14988-1 Rating: moderate Cross-References: CVE-2024-51744 CVE-2024-6104 CVE-2025-22868 CVE-2025-22869 CVE-2025-22870 CVE-2025-27144 CVSS scores: CVE-2024-51744 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-51744 SUS...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...