CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: gptscript, chainctl, grype-db, k9s, undock, zarf, nuclei, k9s-fips, syft-fips, grype, gitleaks, gotenberg, grype-fips, mattermost-fips, filebrowser, syft, kots, kubescape, mattermost, cg, trufflehog, chezmoi, wolfictl, trufflehog-fips...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, spegel, chaos-mesh, kubescape-server-fips, trivy-operator-fips, google-osconfig-agent, datadog-agent, kubescape-operator, neuvector-scanner-fips, falco-no-driver, cluster-api-helm-controller, neuvector, zarf-fips, chainctl-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, spegel, chaos-mesh, kubescape-server-fips, trivy-operator-fips, google-osconfig-agent, k8sgpt, datadog-agent, kubescape-operator, neuvector-scanner-fips, falco-no-driver, cluster-api-helm-controller, neuvector, zarf-fips, chainctl-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, flux-image-automation-controller-fips, external-secrets-operator, kubescape-server-fips, google-osconfig-agent, trivy-operator-fips, gitsign, apko-fips, kyverno, amazon-ssm-agent, pulumi-language-yaml, pulumi-language-dotnet, zarf-fips,...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: envoy-gateway, volcano, spegel, trivy-operator-fips, google-osconfig-agent, datadog-agent, kubescape-operator, neuvector-scanner-fips, skopeo-fips, falco-no-driver, prometheus-node-exporter-fips, virt-handler-fips, kubernetes, ctop-fips, neuvector,...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: envoy-gateway, volcano, spegel, trivy-operator-fips, google-osconfig-agent, datadog-agent, kubescape-operator, neuvector-scanner-fips, skopeo-fips, falco-no-driver, prometheus-node-exporter-fips, virt-handler-fips, kubernetes, ctop-fips, neuvector,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: chainctl, grype-db, k9s, opentofu, zarf, trivy-operator-fips, k9s-fips, xeol, tfsec, syft-fips, grype, tflint, xeol-fips, trivy-fips, snyk-cli, conftest, rancher-fleet, terraform, grype-fips, trivy-operator, steampipe, terragrunt, terraform-fips, syft, conftest-fips,...