sigstore cosign vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20231
3. 20242
4. 20263

Newest CVEs

• CVE-2026-39395

  Cosign's verify-blob-attestation reports false positive when payload parsing fails

  sigstore · cosign

  Medium4.3
• CVE-2026-24122

  Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

  sigstore · cosign

  Low3.7
• CVE-2026-22703

  Cosign verification accepts any valid Rekor entry under certain conditions

  sigstore · cosign

  Medium5.5
• CVE-2024-29903

  Cosign vulnerable to machine-wide denial of service via malicious artifacts

  sigstore · cosign

  Medium4.2
• CVE-2024-29902

  Cosign vulnerable to system-wide denial of service via malicious attachments

  sigstore · cosign

  Medium4.2
• CVE-2023-46737

  Possible endless data attack from attacker-controlled registry in cosign

  sigstore · cosign

  Low3.1
• CVE-2022-36056

  Vulnerabilities with blob verification in sigstore cosign

  sigstore · cosign

  Medium5.5
• CVE-2022-35929

  False positive signature verification in cosign

  sigstore · cosign

  High7.1
• CVE-2022-23649

  Improper Certificate Validation in Cosign

  sigstore · cosign

  Low3.3