CLEANSTART-2026-QR59684 Security fix for GHSA-xm5m-wgh2-rrg3 applied in: cosign-fips 2.6.3-r0, cosign-fips 3.0.6-r1

Security vulnerability affects the cosign-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TK91481 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign-fips package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-IQ57265 sigstore-go is a Go library for Sigstore signing and verification

Security vulnerability affects the cosign-fips package. sigstore-go is a Go library for Sigstore signing and verification...

CLEANSTART-2026-MN20743 Security fix for GHSA-pmwq-pjrm-6p5r applied in: cosign-fips 2.5.3-r1, cosign-fips 2.6.3-r2, cosign-fips 3.0.6-r2

Security vulnerability affects the cosign-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JP58072 Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project

Security vulnerability affects the cosign-fips package. Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project...

CLEANSTART-2026-HC28993 cosign is a container signing and verification utility

Security vulnerability affects the cosign-fips package. cosign is a container signing and verification utility...

CLEANSTART-2026-EV96739 Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure

Security vulnerability affects the cosign-fips package. Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure...

CLEANSTART-2026-VF84041 Cosign is a sigstore signing tool for OCI containers

Security vulnerability affects the cosign-fips package. Cosign is a sigstore signing tool for OCI containers...

CLEANSTART-2026-JJ11203 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign-fips package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: vexctl, falcoctl, cosign-fips, tekton-chains, falcoctl-fips, gitsign, kubescape...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign-fips, slsa-verifier, gh, cosign...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: vexctl, mc, minio, falcoctl, cosign-fips, spire-server-fips, tekton-chains, boring-registry, external-secrets-fips, spire-server, falcoctl-fips, gitsign, kubescape...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: neuvector-fips, bank-vaults, kargo, goreleaser, aactl, cosign-fips, flux-kustomize-controller, timestamp-authority, oauth2-proxy, flux-source-controller, nerdctl, cosign, policy-controller-fips, temporal-ui-server-fips, spire-server, dex-fips, fulcio, dex,...

GO-2026-4355 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, cloudbeat-fips, tekton-chains-fips, buildkitd-fips, witness, kubescape, ratify-fips, image-factory, goreleaser, kyverno-fips, ko-fips, kyverno, gh, kyverno-notation-aws-fips, aactl, trivy-operator, falcoctl, chainctl, cosign-fips,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth, xeol, cortex-fips, grafana-alloy-fips, neuvector-fips, filebrowser, secrets-store-csi-driver-provider-azure, promxy-fips, bank-vaults, kargo, thanos-fips, goreleaser, kyverno-notation-aws-fips, hydra-fips, aactl, k8sgpt, cosign-fips,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: kyverno, falcoctl, goreleaser, crossplane, gitsign, ko, vexctl, trivy-operator, sigstore-scaffolding, docker-cli-buildx, trivy, ratify, flux-source-controller, aactl, witness, tkn, neuvector-sigstore-interface, spire-server, buildkitd, slsa-verifier, docker, gh, zot,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: kyverno, falcoctl, goreleaser, crossplane, gitsign, ko, vexctl, trivy-operator, sigstore-scaffolding, docker-cli-buildx, trivy, ratify, flux-source-controller, aactl, witness, tkn, neuvector-sigstore-interface, spire-server, buildkitd, slsa-verifier, docker, gh, zot,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: conftest-fips, frankenphp-8.3, xeol, commercial-chainloop-backend, containerd, envconsul, gotrue-fips, hydra-fips, aactl, knative-eventing, vault-fips, cloudbeat, flux-source-controller, crossplane-fips, cosign, juicefs, temporal-ui-server-fips, trivy-operator-fips,...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: conftest-fips, frankenphp-8.3, xeol, commercial-chainloop-backend, containerd, envconsul, gotrue-fips, hydra-fips, aactl, knative-eventing, vault-fips, cloudbeat, flux-source-controller, crossplane-fips, cosign, juicefs, temporal-ui-server-fips, trivy-operator-fips,...

GHSA-4QG8-FJ49-PXJH vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, cloudbeat-fips, tekton-chains-fips, witness, kubescape, ratify-fips, image-factory, goreleaser, kyverno-fips, ko-fips, kyverno, gh, kyverno-notation-aws-fips, aactl, falcoctl, chainctl, cosign-fips, image-factory-fips, tekton-chains,...