Vulnerabilities in sigstore

35 results
Vexday analysis

O sigstore registra 35 CVEs na base Vexday, com 8 publicadas nos últimos 90 dias, indicando atividade recente de descoberta de falhas. Nenhuma vulnerabilidade está sob ataque ativo (KEV) e apenas 1 atinge nível crítico, reduzindo o risco imediato. A fraqueza dominante (CWE-347 — falha na validação de assinatura criptográfica) reflete riscos estruturais em componentes de autenticação, demandando revisão arquitetural sobre a confiabilidade da cadeia de assinatura.

CVE-2026-24122LOWCosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be OverlookedEPSS 0.2%CVE-2026-48758MEDIUMsigstore-js: DSSE payloadType type-binding failureEPSS 0.2%CVE-2025-66506HIGHFulcio allocates excessive memory during token parsingEPSS 0.2%CVE-2022-23649LOWImproper Certificate Validation in CosignEPSS 0.2%CVE-2026-24408NONEsigstore has CSRF possibility in OIDC authentication during signingEPSS 0.2%CVE-2022-36056MEDIUM Vulnerabilities with blob verification in sigstore cosignEPSS 0.1%CVE-2026-48815HIGHsigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforcedEPSS 0.1%CVE-2026-48816MEDIUMsigstore-js: Insufficient Verification of Data AuthenticityEPSS 0.1%CVE-2026-44309MEDIUMgitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commitsEPSS 0.1%CVE-2024-51746LOWUse of incorrect Rekor entries during verification in gitsignEPSS 0.1%CVE-2026-49834MEDIUMsigstore-go: Multi-log threshold bypass via single compromised logEPSS 0.1%CVE-2026-44310MEDIUMgitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersEPSS 0.1%CVE-2026-39984MEDIUMSigstore Timestamp Authority has Improper Certificate Validation in verifierEPSS 0.1%CVE-2024-53267MEDIUMVulnerability with bundle verification in sigstore-javaEPSS 0.1%CVE-2026-22703MEDIUMCosign verification accepts any valid Rekor entry under certain conditionsEPSS 0.1%