- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 3 · 2 medium, 1 low
- Registry
- pkg.go.dev
Advisories 3
- CVE-2026-39395Medium 4.3
Cosign's verify-blob-attestation reports false positive when payload parsing fails
Affected: from 3.0.0, fixed in 3.0.6.
- CVE-2026-24122Low 3.7
Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
Affected: fixed in 3.0.5.
- CVE-2026-22703Medium 5.5
Cosign verification accepts any valid Rekor entry under certain conditions
Affected: fixed in 3.0.4.