sigstore sigstore-js

• CVE-2026-118763 High 7.4 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location 0.3%
• CVE-2026-48816 Medium 6.5 sigstore-js: Insufficient Verification of Data Authenticity 0.1%
• CVE-2026-48758 Medium 5.4 sigstore-js: DSSE payloadType type-binding failure 0.2%
• CVE-2026-48815 High 7.5 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced 0.2%
• CVE-2026-59891 Critical 9.6 Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry 0.5%