{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"cosign","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQZF6C72VPH9RNQB7AH0ZP","modified_at":"2026-10-01T03:02:30.527538359Z","published_at":"2026-01-10T07:16:03.030Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-22703","https://security-tracker.debian.org/tracker/CVE-2026-22703"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-22703","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-22703"}],"summary":"Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor"}