271 matches found
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: datadog-agent, falcosidekick, amazon-cloudwatch-agent, grafana, caddy, grafana-alloy, harbor-registry, mcp-grafana, aws-otel-collector, grafana-mimir, fluent-bit-plugin-loki, pulumi-kubernetes-operator, loki, opentofu, grafana-pyroscope, distribution, tempo, zot, kot...
GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...
CVE-2026-81871 vulnerabilities
Vulnerabilities for packages: grafana-geomys-fips, terraform-fips, elastic-agent, datadog-agent-fips, tempo-fips, envoy-ai-gateway-fips, loki-fips, commercial-grafana, envoy-ai-gateway, harbor-registry-fips, percona-grafana, frankenphp-8.3, falcosidekick, aws-otel-collector, zitadel, grafana-allo...
GHSA-W34Q-CM8F-9C5X vulnerabilities
Vulnerabilities for packages: datadog-agent, falcosidekick, amazon-cloudwatch-agent, grafana, caddy, grafana-alloy, harbor-registry, mcp-grafana, aws-otel-collector, grafana-mimir, fluent-bit-plugin-loki, pulumi-kubernetes-operator, loki, opentofu, grafana-pyroscope, distribution, tempo, zot, kot...
CVE-2026-61833
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:16+00:00| published-proof-of-concept| https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25...
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
EUVD-2026-83187
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833
zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CLEANSTART-2026-NW72485 Security fix for CVE-2021-41190 applied in: docker 20.10.11-r0, docker-fips 20.10.11-r0, zot 2.1.13-r2
CVE-2021-41190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-61833: Improper Authorization
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
GO-2026-4942 vulnerabilities
Vulnerabilities for packages: envoy-gateway, portieris, gitness, zot, kots, argocd-image-updater...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, kubeflow-pipelines, cert-manager-istio-csr, emissary, datadog-agent, kube-vip-cloud-provider, cluster-api, kubernetes-csi-external-attacher, kubescape, rke2-cloud-provider, fluent-operator, azure-service-operator, gatekeeper,...
GO-2025-3409 vulnerabilities
Vulnerabilities for packages: zot...