sigstore records

17 published records for vendor sigstore.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

17 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-35929No exploit	False positive signature verification in cosignsigstore · cosign · CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.6%	Aug 4, 2022
35Monitor	CVE-2022-35930No exploit	Ability to bypass attestation verification in sigstore PolicyControllersigstore · policy controller · CWE-347 Weak crypto	High8.8	—	0.6%	Aug 4, 2022
30Monitor	CVE-2024-29903No exploit	Cosign vulnerable to machine-wide denial of service via malicious artifactssigstore · cosign · CWE-770 Pre-auth Denial of service	High7.5	—	0.8%	Apr 10, 2024
30Monitor	CVE-2024-45395No exploit	Unbounded loop over untrusted input can lead to endless data attacksigstore · sigstore-go · CWE-835 Pre-auth Denial of service	High7.5	—	0.4%	Sep 4, 2024
30Monitor	CVE-2026-31830No exploit	sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digestsigstore · sigstore · CWE-252 Pre-auth	High7.5	—	0.2%	Mar 10, 2026
30Monitor	CVE-2026-49834No exploit	sigstore-go: Multi-log threshold bypass via single compromised logsigstore · sigstore-go · CWE-347 Pre-auth Weak crypto	High7.5	—	0.1%	Jul 17, 2026
23Monitor	CVE-2024-29902No exploit	Cosign vulnerable to system-wide denial of service via malicious attachmentssigstore · cosign · CWE-770 Pre-auth Denial of service	Medium5.9	—	0.6%	Apr 10, 2024
22Monitor	CVE-2022-36056No exploit	Vulnerabilities with blob verification in sigstore cosignsigstore · cosign · CWE-347 Weak crypto	Medium5.5	—	0.1%	Sep 14, 2022
22Monitor	CVE-2026-22703No exploit	Cosign verification accepts any valid Rekor entry under certain conditionssigstore · cosign · CWE-345	Medium5.5	—	0.1%	Jan 10, 2026
22Monitor	CVE-2024-53267No exploit	Vulnerability with bundle verification in sigstore-javasigstore · sigstore-java · CWE-347 Weak crypto	Medium5.5	—	0.0%	Nov 26, 2024
21Monitor	CVE-2023-46737No exploit	Possible endless data attack from attacker-controlled registry in cosignsigstore · cosign · CWE-400 Pre-auth Denial of service	Medium5.3	—	0.6%	Nov 7, 2023
21Monitor	CVE-2023-47122No exploit	Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.sigstore · gitsign · CWE-347 Pre-auth Weak crypto	Medium5.3	—	0.3%	Nov 10, 2023
21Monitor	CVE-2026-39395No exploit	Cosign's verify-blob-attestation reports false positive when payload parsing failssigstore · cosign · CWE-754 Pre-auth	Medium5.3	—	0.2%	Apr 7, 2026
14Monitor	CVE-2026-24122No exploit	Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlookedsigstore · cosign · CWE-295 Pre-auth Weak crypto	Low3.7	—	0.2%	Feb 19, 2026
13Monitor	CVE-2022-23649No exploit	Improper Certificate Validation in Cosignsigstore · cosign · CWE-295 Weak crypto	Low3.3	—	0.1%	Feb 18, 2022
8Monitor	CVE-2024-54140No exploit	sigstore-java has a vulnerability with bundle verificationsigstore · sigstore-java · CWE-20	Low2.1	—	0.2%	Dec 5, 2024
7Monitor	CVE-2024-51746No exploit	Use of incorrect Rekor entries during verification in gitsignsigstore · gitsign · CWE-706	Low1.8	—	0.1%	Nov 5, 2024

CVE-2022-35929
39Monitor
False positive signature verification in cosign
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
sigstore · cosignAug 4, 2022
CVE-2022-35930
35Monitor
Ability to bypass attestation verification in sigstore PolicyController
HighCVSS 8.8No exploitEPSS 0%
- Weak crypto
sigstore · policy controllerAug 4, 2022
CVE-2024-29903
30Monitor
Cosign vulnerable to machine-wide denial of service via malicious artifacts
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
sigstore · cosignApr 10, 2024
CVE-2024-45395
30Monitor
Unbounded loop over untrusted input can lead to endless data attack
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
sigstore · sigstore-goSep 4, 2024
CVE-2026-31830
30Monitor
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
sigstore · sigstoreMar 10, 2026
CVE-2026-49834
30Monitor
sigstore-go: Multi-log threshold bypass via single compromised log
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
sigstore · sigstore-goJul 17, 2026
CVE-2024-29902
23Monitor
Cosign vulnerable to system-wide denial of service via malicious attachments
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- Denial of service
sigstore · cosignApr 10, 2024
CVE-2022-36056
22Monitor
Vulnerabilities with blob verification in sigstore cosign
MediumCVSS 5.5No exploitEPSS 0%
- Weak crypto
sigstore · cosignSep 14, 2022
CVE-2026-22703
22Monitor
Cosign verification accepts any valid Rekor entry under certain conditions
MediumCVSS 5.5No exploitEPSS 0%
sigstore · cosignJan 10, 2026
CVE-2024-53267
22Monitor
Vulnerability with bundle verification in sigstore-java
MediumCVSS 5.5No exploitEPSS 0%
- Weak crypto
sigstore · sigstore-javaNov 26, 2024
CVE-2023-46737
21Monitor
Possible endless data attack from attacker-controlled registry in cosign
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Denial of service
sigstore · cosignNov 7, 2023
CVE-2023-47122
21Monitor
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
sigstore · gitsignNov 10, 2023
CVE-2026-39395
21Monitor
Cosign's verify-blob-attestation reports false positive when payload parsing fails
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
sigstore · cosignApr 7, 2026
CVE-2026-24122
14Monitor
Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
sigstore · cosignFeb 19, 2026
CVE-2022-23649
13Monitor
Improper Certificate Validation in Cosign
LowCVSS 3.3No exploitEPSS 0%
- Weak crypto
sigstore · cosignFeb 18, 2022
CVE-2024-54140
8Monitor
sigstore-java has a vulnerability with bundle verification
LowCVSS 2.1No exploitEPSS 0%
sigstore · sigstore-javaDec 5, 2024
CVE-2024-51746
7Monitor
Use of incorrect Rekor entries during verification in gitsign
LowCVSS 1.8No exploitEPSS 0%
sigstore · gitsignNov 5, 2024