{"uuid": "fab2796f-ee1c-43df-a3a8-b2c581cb05ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://bsky.app/profile/persikbl.bsky.social/post/3mu7zqzamlj2f", "content": "In January a cosign bundle could be crafted to verify successfully even though its embedded Rekor entry didn't reference the artifact's digest, signature or public key.\n\nCVE-2026-22703.\n\npodostack.com/p/issue-032...", "creation_timestamp": "2026-08-29T13:56:03.111377Z"}