fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 cosign verify-attestation --policy policy/text4shell.cue --type...

EUVD-2026-54222

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters...

CLEANSTART-2026-ZU97983 sigstore-js provides JavaScript libraries for interacting with Sigstore services

Security vulnerability affects the renovate package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

CLSA-2026-1791840004 TuxCare security update for sigstore (1 CVE)

TuxCare rebuilt sigstore to address 1 CVE. Fixed in 2.3.1-tuxcare.1...

CVE-2026-108699

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosignverifyargs accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image...

cosign

cosign Firma di container OCI e altri artefatti utilizzando Sigstore! Cosign mira a rendere le firme infrastruttura invisibile. Cosign supporta: "Firma senza chiave" con l'autorità di certificazione Fulcio del bene pubblico Sigstore e il registro di trasparenza Rekor predefinito Firma hardware e...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...

CLEANSTART-2026-UX86931 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the cosign package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-LI04504 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the containerd package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-QA16480 Security fix for CVE-2025-61719 applied in: sigstore-scaffolding-fips 0.7.31-r0

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BV58345 Security fix for GHSA-jqc5-w2xx-5vq4 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, kubescape 3.0.47-r0, kyverno-fips 1.16.1-r2, kyverno-fips 1.16.3-r3, sigstore-scaffolding 0.7.31-r1, spire-server 1.14.1-r1, spire-server-fips 1.14.1-r1, tekton-chains 0.26.0-r2, tekton-chains-fips 0.26.0-r2, tkn-fips 0.43.0-r2

GHSA-jqc5-w2xx-5vq4 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TG34900 Security fix for CVE-2025-66506 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, sigstore-scaffolding 0.7.31-r2

CVE-2025-66506 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101433

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

nono v0.78.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

nono v0.74.0

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GO-2026-6162 sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go

sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...