CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: syft, kubescape, chainctl, wolfictl, gptscript, zarf, trufflehog, gotenberg, kots, undock, cg, gitleaks, nuclei, chezmoi, k9s, mattermost-fips, grype, filebrowser, trufflehog-fips, grype-db, syft-fips, grype-fips, mattermost, k9s-fips...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, kubescape, kgateway-fips, kube-mgmt, kubescape-operator, consul-k8s, neuvector-fips, linkerd2-fips, skaffold, neuvector, zarf-fips, harvester-fips, kots, kubescape-server-fips, cg, cloudbeat-fips, datadog-agent, kubescape-server, spegel-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, kubescape, kgateway-fips, kube-mgmt, kubescape-operator, consul-k8s, neuvector-fips, linkerd2-fips, skaffold, neuvector, zarf-fips, harvester-fips, kots, kubescape-server-fips, cg, cloudbeat-fips, datadog-agent, kubescape-server, spegel-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, kubescape, flux-fips, skaffold, terragrunt-fips, gitlab-runner-fips, zarf-fips, trufflehog, grafana-alloy-fips, kots, amazon-ssm-agent, amazon-ssm-agent-fips, kubescape-server-fips, cg, cloudbeat-fips, kubescape-server, bom, k9s,...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: kubernetes, kubescape, kubescape-operator, prometheus-node-exporter-fips, neuvector-fips, nvidia-container-toolkit, skaffold, neuvector, buildah, grafana-alloy-fips, kots, undock, cg, k8s-device-plugin, skopeo-fips, cloudbeat-fips, datadog-agent, spegel-fips, k9s,...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: kubernetes, kubescape, kubescape-operator, prometheus-node-exporter-fips, neuvector-fips, nvidia-container-toolkit, skaffold, neuvector, buildah, grafana-alloy-fips, kots, undock, cg, k8s-device-plugin, skopeo-fips, cloudbeat-fips, datadog-agent, spegel-fips, k9s,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: cloudbeat, xeol-fips, syft, kubescape, chainctl, wolfictl, zot, trivy-fips, opentofu, trivy, conftest-fips, zarf, trivy-operator, opentofu-fips, conftest, kots, terraform-fips, cloudbeat-fips, rancher-fleet-fips, rancher-fleet, tfsec, k9s, tflint, snyk-cli, terraform...