CLEANSTART-2026-XV99350 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

🗓️ 10 Sep 2026 01:29:08Reported by GoogleType

osv🔗 osv.dev👁 11 Views

Malicious GOSUMDB serving arbitrary module content outside the transparency log in kyverno.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation in crypto/x509 [CVE-2025-61729]	14 Apr 202616:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	1 Dec 202516:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in DataStage on Cloud Pak for Data	25 Feb 202616:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	10 Mar 202612:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes April 2026	27 May 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by net/url (Publicly disclosed vulnerability) ( CVE-2025-47912)	4 Sep 202616:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	9 Feb 202611:57	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in golang.org/x/mod bundled with IBM Fusion and IBM Fusion HCI	2 Oct 202618:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to incorrect parse function values in net/url (CVE-2025-47912)	14 Apr 202617:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Allocation of Resources in net/textproto [CVE-2025-61724]	20 Apr 202618:31	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XV99350.json
osv	www.osv.dev/vulnerability/CVE-2025-47912
osv	www.osv.dev/vulnerability/CVE-2025-58183
osv	www.osv.dev/vulnerability/CVE-2025-58185
osv	www.osv.dev/vulnerability/CVE-2025-58186
osv	www.osv.dev/vulnerability/CVE-2025-58187
osv	www.osv.dev/vulnerability/CVE-2025-58188
osv	www.osv.dev/vulnerability/CVE-2025-58189
osv	www.osv.dev/vulnerability/CVE-2025-61723
osv	www.osv.dev/vulnerability/CVE-2025-61724

18 Sep 2026 12:18Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

EPSS0.01467

kyverno GOSUMDB transparency log arbitrary content Go module