GO-2025-3849 vulnerabilities

Vulnerabilities for packages: podman, nri-rabbitmq, gatus, doppler-kubernetes-operator, gitness, k3s, neuvector-dbgen, flux, polaris, rook, sftpgo-plugin-kms, kubescape, cluster-api-gcp-controller, docker, malcontent, git-credential-oauth, k8ssandra-operator, op-geth, sbom-scorecard, cri-tools,...

GO-2025-4155 vulnerabilities

Vulnerabilities for packages: podman, nri-rabbitmq, gitsign, pulumi-kubernetes-operator, gitaly, tempo, flannel-cni-plugin, percona-server-mongodb-operator, gitness, k3s, neuvector-dbgen, terraform-provider-google, polaris, sftpgo-plugin-kms, kubescape, task, k8ssandra-operator, op-geth, sftpgo,...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: teleport, gitsign, slsa-verifier, zot, kyverno-notation-aws, tflint, crossplane, falcoctl, vexctl, skaffold, ko, trivy-operator, gh, goreleaser, spire-server, sigstore-scaffolding, aactl, policy-controller, tkn, kyverno, kubescape, cosign, docker, rekor,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, gatus, gitsign, pulumi-kubernetes-operator, doppler-kubernetes-operator, tempo, aws-efs-csi-driver, gitness, dagdotdev, k3s, terraform-provider-google, flux, rook, kubescape, docker, git-credential-oauth, k8ssandra-operator,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: boring-registry, crossplane-provider-azure-authorization, gitsign, pulumi-kubernetes-operator, tempo, crossplane, distribution, gitness, scorecard, skaffold, vexctl, flyte, step, k3s, flux, rook, openbao, secrets-store-csi-driver-provider-azure, sftpgo-plugin-kms,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: gitsign, slsa-verifier, zot, falcoctl, vexctl, melange, gh, spire-server, sigstore-scaffolding, aactl, wolfictl, policy-controller, tkn, kubescape, cosign, rekor, flux-source-controller, apko, zarf, trivy, neuvector-sigstore-interface, tekton-chains...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, gitsign, pulumi-kubernetes-operator, doppler-kubernetes-operator, tempo, flannel-cni-plugin, gitness, dagdotdev, k3s, neuvector-dbgen, terraform-provider-google, flux, rook, neuvector-scanner, kubescape, docker, task, k8ssandra-operator, sbom-scorecard,...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, nri-rabbitmq, gatus, gitsign, doppler-kubernetes-operator, tempo, flannel-cni-plugin, gitness, dagdotdev, k3s, neuvector-dbgen, terraform-provider-google, flux, rook, neuvector-scanner, sftpgo-plugin-kms, kubescape, docker,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, nri-rabbitmq, gitsign, pulumi-kubernetes-operator, doppler-kubernetes-operator, tempo, flannel-cni-plugin, aws-efs-csi-driver, gitness, dagdotdev, k3s, neuvector-dbgen, terraform-provider-google, flux, rook, neuvector-scanner,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, gitsign, pulumi-kubernetes-operator, doppler-kubernetes-operator, tempo, aws-efs-csi-driver, gitness, dagdotdev, k3s, terraform-provider-google, flux, rook, neuvector-scanner, sftpgo-plugin-kms, kubescape, docker, malcontent,...

GO-2025-3485 vulnerabilities

Vulnerabilities for packages: boring-registry, podman, gatus, gitsign, distribution, vexctl, skaffold, skopeo, flyte, step, dagdotdev, k3s, rook, openbao, neuvector-scanner, sftpgo-plugin-kms, kubescape, guac, rekor, k3d, sftpgo, kube-rbac-proxy, rabbitmq-messaging-topology-operator, tekton-chain...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sops, crossplane-provider-azure-authorization, gitsign, crossplane-provider-azure-storage, opentelemetry-collector, crossplane-provider-azure-managedidentity, pulumi-kubernetes-operator, src-fingerprint, timestamp-authority, slsa-verifier, terraform-provider-azurerm,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, nri-rabbitmq, gitsign, pulumi-kubernetes-operator, doppler-kubernetes-operator, tempo, flannel-cni-plugin, aws-efs-csi-driver, gitness, dagdotdev, k3s, terraform-provider-google, flux, neuvector-scanner, kubescape, task,...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Linux Distros Unpatched Vulnerability : CVE-2026-48791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor ent...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...