Skip to content
OpenAdvisories

Package · Ubuntu

golang-github-sigstore-sigstore

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 2.0
    CVE-2026-48791

    Sigstore Java has a vulnerability with bundle verification of integratedTime

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancemen…

    sigstore sigstore-java dev.sigstore:sigstore-java golang-github-sigstore-sigstore Ubuntu Maven
  • Medium 5.8
    CVE-2026-24137

    sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

    sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base direc…

    sigstore sigstore zot kubescape Debian Ubuntu Wolfi Go