Known vulnerabilities in Cosign

Vendor: Sigstore
Software: Cosign
Software CPE: cpe:2.3::sigstore:cosign:*:*:*:*:*:*:*:*
Total vulnerabilities: 9
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cosign Cosign is affected by 9 known vulnerabilities: 5 medium, 4 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127932 - Improper Certificate Validation
CVE-2026-24122
CWE-295 Low
No
No
3.0.5 25.04.2026 SB20260425214
SB20260425221
#VU127931 - Insufficient Verification of Data Authenticity
CVE-2026-22703
CWE-345 Low
No
No
2.6.2, 3.0.4 25.04.2026 SB20260425213
SB20260425220
#VU125021 - Security Features
CVE-2026-39395
CWE-254 Medium
No
No
2.6.3, 3.0.6 07.04.2026 SB2026040725
SB2026061958
#VU89209 - Resource exhaustion
CVE-2024-29902
CWE-400 Medium
No
No
2.2.4 07.05.2024 SB2024050714
SB2024050719
SB2024061894
and 1 more
#VU89208 - Resource exhaustion
CVE-2024-29903
CWE-400 Medium
No
No
2.2.4 07.05.2024 SB2024050714
SB2024050719
SB2024061894
and 1 more
#VU82940 - Improper input validation
CVE-2023-46737
CWE-20 Low
No
No
2.2.1 09.11.2023 SB2023110924
SB2023121465
#VU67910 - Improper Verification of Cryptographic Signature
CVE-2022-36056
CWE-347 Medium
No
No
1.12.0 04.10.2022 SB2022100442
SB2022100445
SB2022120642
#VU127929 - Improper input validation
CVE-2022-35929
CWE-20 Medium
No
No
1.10.1 04.08.2022 SB2022080445
SB2022082331
#VU127930 - Insufficient Verification of Data Authenticity
CVE-2022-23649
CWE-345 Low
No
No
1.5.2 18.02.2022 SB2022021849