CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: gotenberg, trufflehog, kots, chezmoi, gptscript, k9s-fips, filebrowser, syft-fips, undock, grype-fips, trufflehog-fips, chainctl, grype-db, k9s, zarf, cg, gitleaks, wolfictl, grype, nuclei, mattermost, kubescape, syft, mattermost-fips...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: gatekeeper, kots, chaos-mesh-fips, helm-exporter, linkerd2, google-osconfig-agent, zot, chartmuseum, livekit-cli, docker, steampipe, packer, kaniko, kubescape-operator-fips, cluster-api-helm-controller-fips, chainctl, tigera-operator, docker-compose, chainctl-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: gatekeeper, kots, chaos-mesh-fips, helm-exporter, linkerd2, google-osconfig-agent, zot, chartmuseum, livekit-cli, docker, steampipe, packer, kaniko, kubescape-operator-fips, cluster-api-helm-controller-fips, chainctl, tigera-operator, docker-compose, chainctl-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, kots, argo-workflows-fips, google-osconfig-agent, zot, apko-fips, argocd-image-updater, steampipe, rancher-fleet-fips, grafana-alloy, flux, packer, kaniko, chainctl, gomplate-fips, chainctl-fips, src-fingerprint, terragrunt-fips, snyk-cli, scorecard...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: containerd-fips, kots, kubernetes-csi-driver-nfs-fips, podman, google-osconfig-agent, zot, ctop-fips, sriov-network-device-plugin-fips, grafana-alloy, nvidia-container-toolkit, kubescape-operator-fips, chainctl, virt-handler-fips, nerdctl-fips, checksec, buildah,...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: containerd-fips, kots, kubernetes-csi-driver-nfs-fips, podman, google-osconfig-agent, zot, ctop-fips, sriov-network-device-plugin-fips, grafana-alloy, nvidia-container-toolkit, kubescape-operator-fips, chainctl, virt-handler-fips, nerdctl-fips, checksec, buildah,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: kots, terragrunt, zot, opentofu, syft-fips, xeol-fips, grype-fips, cloudbeat-fips, steampipe, rancher-fleet-fips, tfsec, conftest-fips, terraform, chainctl, cloudbeat, grype-db, terraform-fips, opentofu-fips, trivy-operator, k9s, tflint, trivy, zarf, xeol,...