CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: undock, k9s, wolfictl, filebrowser, kubescape, k9s-fips, cg, mattermost-fips, nuclei, gitleaks, gptscript, grype-fips, grype, gotenberg, syft-fips, mattermost, chezmoi, grype-db, trufflehog, zarf, syft, trufflehog-fips, kots, chainctl...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: cloudbeat, zarf-fips, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, kubevela, chaos-mesh-fips, docker-compose, harvester-fips, kubevela-fips, consul-k8s, grype-fips, grype, trivy-operator-fips, crossplane-fips, spegel-fips, helm, rancher-agent, envoy-gateway-fips...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: cloudbeat, zarf-fips, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, kubevela, chaos-mesh-fips, docker-compose, harvester-fips, kubevela-fips, consul-k8s, grype-fips, grype, trivy-operator-fips, crossplane-fips, spegel-fips, helm, rancher-agent, envoy-gateway-fips...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: cloudbeat, zarf-fips, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, grafana-alloy-fips, grafana-alloy, kyverno, gitaly-fips, nuclei, kubevela, kubevela-fips, argo-workflows-fips, gitlab-runner, apko, grype, grype-fips, cerbos-fips, gitea-fips, trivy-operator-fips...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: nerdctl, kubescape, eks-distro, blob-csi, grafana-alloy-fips, grafana-alloy, podman, kubernetes-csi-driver-nfs-fips, containerd-fips, grype-fips, grype, trivy-operator-fips, skopeo-fips, amazon-k8s-cni-fips, docker-machine-driver-harvester, k8s-device-plugin-fips,...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: nerdctl, kubescape, eks-distro, blob-csi, grafana-alloy-fips, grafana-alloy, podman, kubernetes-csi-driver-nfs-fips, containerd-fips, grype-fips, grype, trivy-operator-fips, skopeo-fips, amazon-k8s-cni-fips, docker-machine-driver-harvester, k8s-device-plugin-fips,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: cloudbeat, k9s, conftest, wolfictl, kubescape, k9s-fips, trivy-operator, cloudbeat-fips, terragrunt, xeol, xeol-fips, rancher-fleet-fips, trivy, grype-fips, grype, opentofu-fips, terraform, trivy-operator-fips, tfsec, terraform-fips, zot, syft-fips, snyk-cli,...