CVE-2022-35930High· 7.1▾ TwilightPolicyController before 0.2.1 may bypass attestation verification
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
0.6% → 0.7%
PolicyController will report a false positive, resulting in an admission when it should not be admitted when:
Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.
github.com/sigstore/policy-controller < 0.2.1Upgrade to a patched release:
github.com/sigstore/policy-controller 0.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-29902Medium· 4.2Cosign malicious attachments can cause system-wide denial of service
CVE-2026-44309Medium· 5.3gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44310Medium· 5.4gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2025-66564High· 7.5Sigstore Timestamp Authority allocates excessive memory during request parsing
CVE-2026-54787Low· 3.1sigstore-go is a Go library for Sigstore signing and verification
CVE-2026-24408None· 0.0sigstore CSRF possibility in OIDC authentication during signing