BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, atlantis, dapr, juicefs, splunk-otel-collector-fips, gitea, falcosidekick-fips, oauth2-proxy, argo-cd-fips, gitea-fips, loki, loki-fips, splunk-otel-collector, argo-cd, traefik-fips, authservice, mattermost-fips, kots, dapr-fips,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: ratify, docker, image-factory, skaffold-fips, ko, spire-server, tekton-chains-fips, trivy-operator, ko-fips, buildkitd-fips, crossplane-fips, tkn-fips, teleport-operator-fips, cloudbeat, trivy-operator-fips, zot, cg, falcoctl-fips, cosign, kyverno-notation-aws-fips,...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: ratify, docker, image-factory, skaffold-fips, ko, spire-server, tekton-chains-fips, trivy-operator, ko-fips, buildkitd-fips, crossplane-fips, tkn-fips, teleport-operator-fips, cloudbeat, trivy-operator-fips, zot, cg, falcoctl-fips, cosign, kyverno-notation-aws-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: spire-server, tekton-chains-fips, falcoctl-fips, melange, cosign, tekton-chains, neuvector-sigstore-interface, sigstore-scaffolding-fips, kubescape, flux-source-controller-fips, zot, slsa-verifier, gitsign, policy-controller-fips, zarf, chainctl, vexctl, aactl,...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: rekor, timestamp-authority, cortex, fulcio, prometheus-alertmanager, grafana-mimir...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: prometheus, kwok, cortex, hydra, kubernetes-csi-external-attacher, traefik, otel-cli, grafana, cluster-api-helm-controller, azurefile-csi, argo-workflows, fluent-operator, sftpgo-plugin-kms, k6, grafana-pyroscope, syft, policy-controller, external-secrets-operator,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rekor, step, prometheus-operator, flux-kustomize-controller, cortex, nuclei, trivy, grafana-mimir, airflow, rclone, up, trino, opentelemetry-collector-contrib, tekton-chains, chezmoi, thanos, tempo, argo-events, falcoctl, fluent-bit-plugin-loki, zot, tkn,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: rekor, flux-kustomize-controller, tekton-chains, tkn, argo-workflows, kubescape, dex, cloudflared, fulcio, aactl, gitsign, terragrunt, spire-server, slsa-verifier, oauth2-proxy, cosign, kots, vexctl, sops, flux-source-controller...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: rekor, trivy, kyverno-notation-aws, teleport, tekton-chains, tflint, ko, zot, falcoctl, tkn, kubescape, goreleaser, witness, zarf, policy-controller, skaffold, ratify, aactl, gitsign, buildkitd, docker, neuvector-sigstore-interface, spire-server, slsa-verifier,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rekor, crossplane-provider-family-azure, flux-kustomize-controller, snyk-cli, nuclei, grafana-mimir, src-fingerprint, actions-runner-controller, opentelemetry-collector-contrib, flux-notification-controller, scorecard, tekton-chains, flux-image-automation-controller,...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

EUVD-2026-57928

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...