dev.sigstore:sigstore-java vulnerabilities

CVEs whose affected-version data names the dev.sigstore:sigstore-java package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-48791Low· 2.0

1mo ago

sigstore-java is a sigstore java client for interacting with sigstore infrastructure

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verifi…

▾ Sunlitsigstore · dev.sigstore:sigstore-javaEPSS 0.07%via NVD