#cwe-324

共收录 3 条相关情报。

← 返回所有主题

漏洞预警2026-07-31 发布LOW

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an Expiri...

CVE-2026-54787

sigstore-go 是 Sigstore 生态系统中用于生成和验证签名 bundle 的 Go 语言库，Sigstore 通过透明日志和证书/密钥管理来保证软件供应链的完整性。在本漏洞中，开发者使用 ExpiringKey 机制包装了一

历史摘要 · 未重新核验 · NVD

安全公告2026-07-31 发布INFO

sigstore-go fails to check signature timestamps against a signing key's validity period

CVE-2026-54787

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-324 #severity:low

漏洞预警2026-06-24 发布INFO

Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not con...

CVE-2026-52809

Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.Act

历史摘要 · 未重新核验 · NVD

#cve #cwe-324 #cwe-613