CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: gotenberg, syft-fips, kots, cg, zarf, grype-fips, mattermost, chezmoi, syft, filebrowser, k9s, gitleaks, nuclei, chainctl, wolfictl, trufflehog, kubescape, grype, undock, grype-db, trufflehog-fips, k9s-fips, gptscript, mattermost-fips...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: helmfile, syft-fips, tekton-pipelines-fips, beats-fips, ctop, rancher-agent, docker, scorecard, spegel, google-osconfig-agent, rancher, kubescape-server-fips, cluster-api-helm-controller-fips, tigera-operator-fips, containerd, k9s, helm, chainctl-fips, teleport,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: helmfile, syft-fips, ctop, rancher-agent, docker, scorecard, spegel, google-osconfig-agent, rancher, kubescape-server-fips, cluster-api-helm-controller-fips, tigera-operator-fips, k9s, helm, chainctl-fips, teleport, headlamp, neuvector-fips, buildkitd-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: syft-fips, scorecard, argo-workflows, google-osconfig-agent, cerbos-fips, external-secrets-operator-fips, kubescape-server-fips, grafana-alloy-fips, flux-source-controller, gitlab-runner-fips, gitea, k9s, chainctl-fips, nuclei, teleport, pulumi, gomplate, trivy-fips,...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: syft-fips, ctop, k8s-device-plugin, rancher-agent, sriov-network-device-plugin-fips, nvidia-container-toolkit, spegel, google-osconfig-agent, cluster-autoscaler-fips, rancher, sriov-network-device-plugin, virt-handler-fips, nerdctl-fips, grafana-alloy-fips, kubernete...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: syft-fips, ctop, k8s-device-plugin, rancher-agent, sriov-network-device-plugin-fips, nvidia-container-toolkit, spegel, google-osconfig-agent, cluster-autoscaler-fips, rancher, sriov-network-device-plugin, virt-handler-fips, nerdctl-fips, grafana-alloy-fips, kubernete...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: syft-fips, kots, terraform-fips, zarf, zot, tflint, grype-fips, trivy-operator, cloudbeat, trivy, rancher-fleet-fips, syft, k9s, chainctl, wolfictl, opentofu-fips, tfsec, xeol, rancher-fleet, kubescape, opentofu, grype, terraform, trivy-fips, xeol-fips, conftest,...