GI
Product
gitsign
4
CVEs
0
On KEV
5.4
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 3Low 1
Watch
Add gitsign to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44310 | 5.4 | May 15 | gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers Affected: >= 0.4.0, < 0.15.0 |
| CVE-2026-44309 | 5.3 | May 15 | gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits Affected: < 0.16.0 |
| CVE-2023-47122 | 5.3 | Nov 10 | Gitsign is software for keyless Git signing using Sigstore Affected: 0.6.0 before 0.8.0 |
| CVE-2024-51746 | 1.8 | Nov 5 | Use of incorrect Rekor entries during verification in gitsign Affected: < 0.11.0 |
Showing 4