sigstore cosign

• CVE-2026-39395 Medium 4.3 Cosign's verify-blob-attestation reports false positive when payload parsing fails 0.2%
• CVE-2026-24122 Low 3.7 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked 0.2%
• CVE-2026-22703 Medium 5.5 Cosign verification accepts any valid Rekor entry under certain conditions 0.1%
• CVE-2024-29903 Medium 4.2 Cosign vulnerable to machine-wide denial of service via malicious artifacts 0.9%
• CVE-2024-29902 Medium 4.2 Cosign vulnerable to system-wide denial of service via malicious attachments 0.7%
• CVE-2023-46737 Low 3.1 Possible endless data attack from attacker-controlled registry in cosign 0.6%
• CVE-2022-36056 Medium 5.5 Vulnerabilities with blob verification in sigstore cosign 0.1%
• CVE-2022-35929 High 7.1 False positive signature verification in cosign 0.7%
• CVE-2022-23649 Low 3.3 Improper Certificate Validation in Cosign 0.2%