GHSA-85JX-FM8M-X8C6 zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the tag already exists and reference != "latest". as a result, when latest already exists, a user who is allowed to create but not allowe...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

Summary : CVE-2026-31801 affects zot, an OCI distribution registry, where the dist-spec authorization middleware misclassifies PUT /v2/{name}/manifests/{reference} as create and only switches to update when the tag exists and reference != "latest". As a result, a user allowed to create (but not u...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

zot 安全漏洞

Zot is an open-source OCI image registry developed by The Zot Project. Versions 1.3.0 to 2.1.14 of Zot contain security vulnerabilities. These vulnerabilities stem from the improper operation inference of the dist-spec authorization middleware when handling PUT /v2/name/manifests/reference...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, docker-compose-fips, cluster-api-provider-vsphere, k8sgpt, temporal-server, velero, tkn, kyverno-policy-reporter-plugins-kyverno-fips, witness, keda, terragrunt, cloudprober-fips, jaeger-operator-fips, eck-operator-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: q, flux-kustomize-controller, cilium-cli, crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, flux-source-controller, snyk-cli, aactl, crossplane-provider-aws-lambda, argo-events, docker-cli-buildx, buildkitd, trivy-operator, opentofu, extism,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: q, flux-kustomize-controller, cilium-cli, crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, flux-source-controller, snyk-cli, aactl, crossplane-provider-aws-lambda, argo-events, docker-cli-buildx, buildkitd, trivy-operator, opentofu, extism,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: k9s-fips, kubescape-server-fips, crossplane-provider-aws-s3, cloudbeat, crossplane-provider-aws-lambda, terraform-provider-azuread-fips, crossplane-provider-aws-cognitoidentity-fips, kyverno-policy-reporter-plugins-kyverno-fips, crossplane-provider-aws-efs-fips,...

zot-registry-2.1.14-1.1 on GA media (moderate)

zot-registry-2.1.14-1.1 on GA media Announcement ID: openSUSE-SU-2026:10100-1 Rating: moderate Cross-References: CVE-2025-30204 CVSS scores: CVE-2025-30204 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-30204 SUSE : 8.7...

OPENSUSE-SU-2026:10100-1 zot-registry-2.1.14-1.1 on GA media

These are all security issues fixed in the zot-registry-2.1.14-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-39897

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...

EUVD-2025-16350

Malicious code in bioql PyPI...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: conftest, trivy, zarf, syft, snyk-cli, tfsec, xeol, grype, kubescape, wolfictl, zot, steampipe, trivy-operator, k9s, opentofu, tflint, kots, terragrunt, rancher-fleet, terraform...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: conftest, trivy, zarf, syft, snyk-cli, tfsec, xeol, grype, kubescape, wolfictl, zot, steampipe, trivy-operator, k9s, opentofu, tflint, kots, terragrunt, rancher-fleet, terraform...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: rancher-fleet, k9s-fips, snyk-cli, cloudbeat, trivy-fips, xeol, tfsec, opentofu, cloudbeat-fips, conftest, grype, terragrunt, chainctl, terraform, syft, zarf, kubescape, grype-db, tflint, terraform-fips, xeol-fips, trivy-operator, wolfictl, steampipe, kots, k9s,...

SUSE CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...