Vendor
Sigstore
40 known vulnerabilities in products by Sigstore, 0 of them actively exploited (CISA KEV).
Key figures
40
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-49835 | Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality | 7.5 | |
| Critical | CVE-2026-59891 | Sigstore-js: Insufficiently Protected Credentials | 9.6 | |
| High | CVE-2026-48702 | Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic | 7.5 | |
| High | CVE-2023-30551 | Rekor's compressed archives can result in OOM conditions | 7.5 | |
| High | CVE-2026-49478 | Sigstore Fulcio: Server-Side Request Forgery (SSRF) | 8.7 | |
| High | CVE-2026-118763 | @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location | 7.4 | |
| High | CVE-2025-66564 | Sigstore Timestamp Authority allocates excessive memory during request parsing | 7.5 | |
| High | CVE-2025-66506 | Fulcio allocates excessive memory during token parsing | 7.5 | |
| High | CVE-2022-35930 | Ability to bypass attestation verification in sigstore PolicyController | 7.1 | |
| High | CVE-2026-49834 | sigstore-go: Multi-log threshold bypass via single compromised log | 7.5 | |
| Critical | CVE-2022-35929 | False positive signature verification in cosign | 7.1 | |
| High | CVE-2026-48815 | sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced | 7.5 | |
| High | CVE-2026-31830 | sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest | 7.5 | |
| Medium | CVE-2026-48816 | sigstore-js: Insufficient Verification of Data Authenticity | 6.5 | |
| High | CVE-2024-29903 | Cosign vulnerable to machine-wide denial of service via malicious artifacts | 4.2 | |
| Medium | CVE-2026-24137 | sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal | 5.8 | |
| Medium | CVE-2026-23831 | Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message | 5.3 | |
| Medium | CVE-2023-33199 | malformed proposed intoto v0.0.2 entries can cause a panic in Rekor | 5.3 | |
| Medium | CVE-2026-48758 | sigstore-js: DSSE payloadType type-binding failure | 5.4 | |
| Medium | CVE-2026-24117 | Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL | 5.3 | |
| Medium | CVE-2024-29902 | Cosign vulnerable to system-wide denial of service via malicious attachments | 4.2 | |
| Medium | CVE-2026-44310 | gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers | 5.4 | |
| Medium | CVE-2026-44309 | Sigstore Gitsign: Improper Certificate Validation | 5.3 | |
| Medium | CVE-2026-22772 | Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass | 5.8 | |
| Medium | CVE-2026-39984 | Sigstore Timestamp Authority has Improper Certificate Validation in verifier | 5.5 |
Products
| Cosign | 9 | 0 |
| Rekor | 5 | 0 |
| Sigstore-js | 5 | 0 |
| Gitsign | 4 | 0 |
| Fulcio | 3 | 0 |
| Sigstore-java | 3 | 0 |
| Sigstore sigstore-go | 3 | 0 |
| Timestamp-authority | 3 | 0 |