sigstore
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 15 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 18, 2022 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
No CWE data available
Most Affected Products
Recent Vulnerabilities
See more →sigstore-go: Multi-log threshold bypass via single compromised log
Cosign's verify-blob-attestation reports false positive when payload parsing fails
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
Cosign verification accepts any valid Rekor entry under certain conditions
Sigstore Timestamp Authority allocates excessive memory during request parsing
Unbounded loop over untrusted input can lead to endless data attack
Cosign vulnerable to machine-wide denial of service via malicious artifacts
Cosign vulnerable to system-wide denial of service via malicious attachments
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Monitor sigstore in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.