604 matches found
CVE-2026-31830
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...
CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: rancher-machine, crossplane-provider-aws-s3, pulumi-kubernetes-operator, tofu-controller, cluster-api-gcp-controller, crossplane-provider-aws-sns, kube-fluentd-operator, crossplane-provider-aws-rds, docker-cli, spire-controller-manager, terraform-provider-azapi, temp...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: rancher-machine, crossplane-provider-aws-s3, pulumi-kubernetes-operator, tofu-controller, cluster-api-gcp-controller, crossplane-provider-aws-sns, kube-fluentd-operator, crossplane-provider-aws-rds, docker-cli, spire-controller-manager, terraform-provider-azapi, temp...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: cloud-provider-aws, crossplane-provider-aws-s3, tofu-controller, terraform-provider-azapi, metrics-agent, kubernetes-csi-external-provisioner, mcp-grafana, temporal-server, tetragon, grafana-operator, cilium-envoy, containerd, bank-vaults, terraform-provider-sendgrid...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: cloud-provider-aws, crossplane-provider-aws-s3, tofu-controller, terraform-provider-azapi, metrics-agent, kubernetes-csi-external-provisioner, mcp-grafana, temporal-server, tetragon, grafana-operator, cilium-envoy, containerd, bank-vaults, terraform-provider-sendgrid...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: cloud-provider-aws, crossplane-provider-aws-s3, tofu-controller, terraform-provider-azapi, metrics-agent, kubernetes-csi-external-provisioner, mcp-grafana, wazero, temporal-server, tetragon, grafana-operator, cilium-envoy, containerd, bank-vaults,...
PT-2026-24484
Name of the Vulnerable Software and Affected Versions sigstore-ruby versions prior to 0.2.3 Description The software does not correctly handle verification failures when the artifact digest does not match the digest in the in-toto attestation subject. Specifically, the Sigstore::Verifierverify...
Sigstore 安全漏洞
Sigstore is an open-source software signature verification library developed by sigstore. Versions of Sigstore prior to 0.2.3 contained security vulnerabilities. These vulnerabilities stemmed from the improper propagation of failure messages during the verification process, which could lead to...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2026:0777-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0777-1 advisory. Update to version 3.0.5 jscSLE-23879. Security issues fixed: - CVE-2025-11065:...
GO-2026-4529 Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign...
UBUNTU-CVE-2026-24122
Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...
CVE-2026-24122
Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper validation of certificate chains during signature verification when transparency log verification is skipped. An attacker can cause acceptance of signatures with expired intermediate...
GO-2026-4358 Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore
Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore...
GO-2026-4355 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
Rekor affected by Server-Side Request Forgery SSRF via provided public key URL in github.com/sigstore/rekor...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: grafana, grafana-fips, boring-registry-fips, gitlab-cng, beats-fips, kyverno, docker-compose-fips, ratify-fips, gitlab-cng-fips, tkn-fips, neuvector-sigstore-interface-fips, beats, bank-vaults, jitsucom-bulker, rancher-security-scan, kyverno-notation-aws-fips, zitade...
CVE-2026-24408
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. OAuthSession creates a unique "state" and sends it as a parameter in the authentication request bu...
SUSE CVE-2026-24408
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. OAuthSession creates a unique "state" and sends it as a parameter in the authentication request bu...