| CVE-2026-44310 |
medium |
5.4 |
5.4 |
|
|
|
20d ago |
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereference… |
| CVE-2026-44309 |
medium |
5.3 |
5.3 |
|
|
|
20d ago |
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's … |
| CVE-2024-51746 |
unknown |
— |
— |
|
|
|
2y ago |
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are … |
| CVE-2023-47122 |
unknown |
— |
— |
|
|
|
3y ago |
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the loc… |
