Known Vulnerabilities for Sigstore-go by Sigstore
Listed below are 1 of the newest known vulnerabilities associated with "Sigstore-go" by "Sigstore".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-108699 json | hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious Web... | Not Provided | 2026-10-11 | 2026-10-13 |
| CVE-2026-64655 json | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Sub... | Not Provided | 2026-08-06 | 2026-08-08 |
| CVE-2026-54787 json | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signin... | Not Provided | 2026-07-31 | 2026-07-31 |
| CVE-2026-49834 json | Not Provided | 2026-07-17 | 2026-07-30 | |
| CVE-2026-48791 json | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verif... | Not Provided | 2026-08-13 | 2026-08-13 |