Linuxfoundation Rekor vulnerabilities

4 CVEs affecting Linuxfoundation Rekor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24117, published 2026-01-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-30551, published 2023-05-08. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory…
CVE-2023-33199, published 2023-05-26. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a…
CVE-2026-23831, published 2026-01-22. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty…
CVE-2026-24117, published 2026-01-22. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public…