GO-2025-3485 vulnerabilities

Vulnerabilities for packages: policy-controller, kargo, spire-server, spire-controller-manager, temporal, weaviate, vault-benchmark, rabbitmq-messaging-topology-operator, flux-kustomize-controller, argocd-image-updater, skopeo, flyte, steampipe, tkn, caddy, grpc-health-probe, step-issuer, aactl,...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloudflared, sbom-convert, postgres-operator, weaviate, age, smarter-device-manager, hugo-extended, k6, aws-application-networking-k8s, rancher-webhook, amazon-cloudwatch-agent, filebrowser,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, kargo, nri-kubernetes, cloudflared, postgres-operator, weaviate, smarter-device-manager, hugo-extended, k6, aws-application-networking-k8s, amazon-cloudwatch-agent, filebrowser, gitea, kserve-rest-proxy, timoni, atlantis,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloudflared, sbom-convert, postgres-operator, weaviate, age, smarter-device-manager, hugo-extended, k6, trino, gitea, kserve-rest-proxy, timoni, atlantis, kube-logging-operator, gh,...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: dive, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloudflared, postgres-operator, weaviate, age, smarter-device-manager, timoni, atlantis, kube-logging-operator, gh, haproxy-ingress, nri-haproxy, kyverno-policy-reporter-kyverno-plugin, sbom-scorecard,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, policy-controller, flux-image-reflector-controller, tekton-chains, kargo, spire-server, crossplane-provider-family-azure, gitsign, vexctl, buildkitd, flux-source-controller, nuclei, opentelemetry-collector,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: dive, cortex, flannel-cni-plugin, crane, kargo, nri-kubernetes, cloudflared, postgres-operator, smarter-device-manager, hugo-extended, timoni, atlantis, kube-logging-operator, gh, haproxy-ingress, nri-haproxy, crossplane-provider-aws-kms,...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Linux Distros Unpatched Vulnerability : CVE-2026-48791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor ent...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-49834

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

ROOT-APP-NPM-CVE-2026-48816 CVE-2026-48816 in @sigstore/verify - Patched by Root

Root has patched CVE-2026-48816 in the @sigstore/verify package for Root:npm. Multiple fixed versions available...

CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

UBUNTU-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.321 Vulnerability Details CVEID:CVE-2026-48815 DESCRIPTION: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...