271 matches found
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: zot, loki, tempo, grafana-pyroscope, distribution, harbor-registry, caddy, datadog-agent, kots, aws-otel-collector, fluent-bit-plugin-loki, grafana-mimir, grafana, mcp-grafana, falcosidekick, amazon-cloudwatch-agent, opentofu, grafana-alloy, pulumi-kubernetes-operato...
GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...
CVE-2026-81871 vulnerabilities
Vulnerabilities for packages: opentelemetry-go-instrumentation, frankenphp-8.5, distribution, zot, frankenphp-8.4, amazon-cloudwatch-agent-fips, opentofu, pulumi-kubernetes-operator, terraform-fips, terraform, harbor-registry, dynatrace-operator, envoy-ai-gateway-fips, grafana-mimir,...
GHSA-W34Q-CM8F-9C5X vulnerabilities
Vulnerabilities for packages: zot, loki, tempo, grafana-pyroscope, distribution, harbor-registry, caddy, datadog-agent, kots, aws-otel-collector, fluent-bit-plugin-loki, grafana-mimir, grafana, mcp-grafana, falcosidekick, amazon-cloudwatch-agent, opentofu, grafana-alloy, pulumi-kubernetes-operato...
CVE-2026-61833
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:16+00:00| published-proof-of-concept| https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25...
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
EUVD-2026-83187
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833
zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...
CLEANSTART-2026-NW72485 Security fix for CVE-2021-41190 applied in: docker 20.10.11-r0, docker-fips 20.10.11-r0, zot 2.1.13-r2
CVE-2021-41190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-61833: Improper Authorization
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
GO-2026-4942 vulnerabilities
Vulnerabilities for packages: portieris, zot, envoy-gateway, argocd-image-updater, kots, gitness...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cluster-api-azure-controller, external-secrets-operator, zot, kwok, kubernetes-csi-external-snapshotter, telegraf, kubeflow-pipelines, rancher-agent, kubernetes-csi-external-attacher, cloud-provider-gcp-cloud-controller-manager, node-feature-discovery, cass-operator,...
GO-2023-1589 vulnerabilities
Vulnerabilities for packages: zot...