CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...

CVE-2026-24122 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...

CVE-2026-24122

Cosign

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper validation of certificate chains during signature verification when transparency log verification is skipped. An attacker can cause acceptance of signatures with expired intermediate...

Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...

GHSA-WFQV-66VQ-46RM Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: hydra, dex, sftpgo, argo-workflows, dbmate, kubeflow-pipelines, juicefs, crossplane-provider-sql, ksops, sftpgo-plugin-eventstore, dgraph, kots, wolfictl, cerbos, spire-server, envoy-gateway, caddy, age, step, step-kms-plugin, fulcio, temporal-server, trillian, aactl...

PT-2026-20949

Name of the Vulnerable Software and Affected Versions Cosign versions 3.0.4 and below Description Cosign is a tool that provides code signing and transparency for containers and binaries. A flaw in the certificate validation process allows expired intermediate Certificate Authorities to validate...

Qualys Recognized as a Leader in the 2026 Forrester Wave™ for CNAPP

Qualys’ Key Takeaways Qualys Named a Leader: Recognized as one of only three leaders in The Forrester Wave: Cloud-Native Application Protection Solutions CNAPP, Q1 2026. Unified Platform: “Qualys has been actively expanding its platform to cover CSPM, CIEM, and even SaaS security posture manageme...

Microsoft Finds “Summarize with AI” Prompts Manipulating Chatbot Recommendations

New research from Microsoft has revealed that legitimate businesses are gaming artificial intelligence AI chatbots via the "Summarize with AI" button that's being increasingly placed on websites in ways that mirror classic search engine poisoning SEO. The new AI hijacking technique has been...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libpng vulnerabilities (USN-8035-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8035-1 advisory. It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma...

Inspecting the Source of Go Modules

Go has indisputably the best package integrity story of any programming language ecosystem. The Go Checksum Database guarantees that every Go client in the world is using the same source for a given Go module and version, forever. It works despite the decentralized nature of Go modules, which can...

USN-8035-1: libpng vulnerabilities

It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a...

USN-8035-1 libpng1.6 vulnerabilities

It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a...

ICE Agent’s ‘Dragging’ Case May Help Expose Evidence in Renee Good Shooting

The government has withheld details of the investigation of Renee Good’s killing—but an unrelated case involving the ICE agent who shot her could force new revelations...

Astra Linux – Vulnerability in gnutls28

A heap-buffer-overread vulnerability was discovered in GnuTLS regarding its handling of the Certificate Transparency CT Signed Certificate Timestamp SCT extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension OID...

TikTok Forms U.S. Joint Venture to Continue Operations Under 2025 Executive Order

TikTok on Friday officially announced that it formed a joint venture that will allow the hugely popular video-sharing application to continue operating in the U.S. The new venture, named TikTok USDS Joint Venture LLC, has been established in compliance with the Executive Order signed by U.S...

CVE-2025-15523 TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app

MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control TCC permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the...

OESA-2026-1128 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: LIBPNG is a reference libra...

OESA-2026-1125 libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fixes: LIBPNG is a reference libra...