GHSA-7C37-GX6W-8VC5 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

Summary CertVerifier.Verify in pkg/git/verifier.go unconditionally dereferences certs0 after sd.GetCertificates without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates returns an empty slice with no error,...

PT-2026-39243

Name of the Vulnerable Software and Affected Versions Gitsign versions prior to 0.16.0 Description gitsign verify and gitsign verify-tag re-encode commit or tag objects using the EncodeWithoutSignature function from the go-git library before checking the signature, rather than verifying the raw g...

CVE-2026-44309

creationtimestamp| type| source ---|---|--- 2026-05-06 16:05:09+00:00| published-proof-of-concept| https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc...

CVE-2026-44310

creationtimestamp| type| source ---|---|--- 2026-05-04 16:54:58+00:00| published-proof-of-concept| https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: tflint, ko, docker, gh, teleport, neuvector-sigstore-interface, sigstore-scaffolding, kyverno, tekton-chains, buildkitd, policy-controller, trivy-operator, skaffold, aactl, zot, zarf, flux-source-controller, kubescape, gitsign, slsa-verifier, goreleaser, crossplane,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: tflint, ko, docker, gh, teleport, neuvector-sigstore-interface, sigstore-scaffolding, kyverno, tekton-chains, buildkitd, policy-controller, trivy-operator, skaffold, aactl, zot, zarf, flux-source-controller, kubescape, gitsign, slsa-verifier, goreleaser, crossplane,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kargo, kubescape-operator, descheduler, filebrowser, nerdctl, karpenter, kine, amazon-cloudwatch-agent-operator, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, terraform-provider-pagerduty, spqr, volume-modifier-for-k8s, cue,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-issuer, timestamp-authority, temporal, kine, kyverno-policy-reporter, dex, flux-kustomize-controller, age, grafana-alloy, minio, openfga, sftpgo-plugin-eventstore, step, kubeflow-pipelines, step-ca, envoy-gateway, nri-mysql, jitsucom-bulker, wolfictl, gitea, sop...

EUVD-2024-3224

Malicious code in bioql PyPI...

EUVD-2023-3067

Malicious code in bioql PyPI...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: grafana-operator, confluent-common-docker, local-path-provisioner, octo-sts, linkerd2-proxy-init, mongodb-kubernetes-operator, shfmt, k8sgpt-operator, custom-pod-autoscaler-operator, cloud-provider-aws, lvm-driver, addon-resizer, pvc-autoresizer, sftpgo-plugin-pubsub...

CVE-2023-47122

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

Incorrect Rekor Entry Selection

github.com/sigstore/gitsign is vulnerable to Incorrect Rekor entry selection. The vulnerability is due to gitsign not correctly handling situations where multiple Rekor entries are returned during online verification, leading it to potentially select the wrong one. It allows an attacker to...

SUSE CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...