Sigstore Rekor
5 CVEs affecting Sigstore Rekor. Latest disclosed: 2026-08-13. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48702 | High | 7.5 | 2026-08-13 | Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpin… |
CVE-2023-30551 | High | 7.5 | 2023-05-08 | Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading… |
CVE-2026-24117 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index… |
CVE-2026-23831 | Medium | 5.3 | 2026-01-22 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicali… |
CVE-2023-33199 | Medium | 5.3 | 2023-05-26 | Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of… |