Product by Sigstore
Cosign
9 known vulnerabilities in Cosign (Sigstore), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-35929 | False positive signature verification in cosign | 7.1 | |
| High | CVE-2024-29903 | Cosign vulnerable to machine-wide denial of service via malicious artifacts | 4.2 | |
| Medium | CVE-2024-29902 | Cosign vulnerable to system-wide denial of service via malicious attachments | 4.2 | |
| Medium | CVE-2026-22703 | Cosign verification accepts any valid Rekor entry under certain conditions | 5.5 | |
| Medium | CVE-2023-46737 | Possible endless data attack from attacker-controlled registry in cosign | 3.1 | |
| Medium | CVE-2026-39395 | Cosign's verify-blob-attestation reports false positive when payload parsing fails | 4.3 | |
| Low | CVE-2026-24122 | Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked | 3.7 | |
| Medium | CVE-2022-36056 | Vulnerabilities with blob verification in sigstore cosign | 5.5 | |
| Low | CVE-2022-23649 | Improper Certificate Validation in Cosign | 3.3 |