Product by Sigstore

    Sigstore-js

    5 known vulnerabilities in Sigstore-js (Sigstore), 0 of them actively exploited (CISA KEV).

    Key figures

    5

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Sigstore-js (Sigstore)
    CriticalCVE-2026-59891

    Sigstore-js: Insufficiently Protected Credentials

    		9.6
    HighCVE-2026-118763

    @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

    		7.4
    HighCVE-2026-48815

    sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

    		7.5
    MediumCVE-2026-48816

    sigstore-js: Insufficient Verification of Data Authenticity

    		6.5
    MediumCVE-2026-48758

    sigstore-js: DSSE payloadType type-binding failure

    		5.4

    All products by Sigstore