sigstore-ruby vulnerabilities

1 known vulnerability in sigstore-ruby from Sigstore. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  sigstore-ruby: Unchecked Return Value

  CVE-2026-31830Mar 10, 2026Sigstore

  sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match