{"vulnerability": "cve-2026-22703", "sightings": [{"uuid": "90241dc6-f453-47be-bb85-d9fe3f220646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "3ade0fdf-0125-485a-bf38-05c3b689ef78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://gist.github.com/alon710/1fb96b420a8b830c89c04efb72f37651", "content": "", "creation_timestamp": "2026-01-24T21:25:39.000000Z"}, {"uuid": "b7c0d469-f745-4bc0-bbc6-b6a681afc396", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://gist.github.com/alon710/5ac3689b8a5fa01f88bcf801ac1b0886", "content": "", "creation_timestamp": "2026-01-24T22:41:03.000000Z"}, {"uuid": "fab2796f-ee1c-43df-a3a8-b2c581cb05ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://bsky.app/profile/persikbl.bsky.social/post/3mu7zqzamlj2f", "content": "In January a cosign bundle could be crafted to verify successfully even though its embedded Rekor entry didn't reference the artifact's digest, signature or public key.\n\nCVE-2026-22703.\n\npodostack.com/p/issue-032...", "creation_timestamp": "2026-08-29T13:56:03.111377Z"}]}