GHSA-85JX-FM8M-X8C6 zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the tag already exists and reference != "latest". as a result, when latest already exists, a user who is allowed to create but not allowe...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

Summary : CVE-2026-31801 affects zot, an OCI distribution registry, where the dist-spec authorization middleware misclassifies PUT /v2/{name}/manifests/{reference} as create and only switches to update when the tag exists and reference != "latest". As a result, a user allowed to create (but not u...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

zot 安全漏洞

Zot is an open-source OCI image registry developed by The Zot Project. Versions 1.3.0 to 2.1.14 of Zot contain security vulnerabilities. These vulnerabilities stem from the improper operation inference of the dist-spec authorization middleware when handling PUT /v2/name/manifests/reference...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller-fips, falcosidekick-fips, skaffold, jobset-fips, livekit-server-fips, temporal-server-fips, terraform-provider-grafana-fips, terragrunt, envoy-gateway, docker-fips, steampipe, kubescape, cortex-fips, kapp-controller-fips, src,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: nfpm, k9s, crossplane-provider-aws-ec2, vcluster, zarf, crossplane-provider-aws-firehose, gitsign, pulumi-language-dotnet, trivy, snyk-cli, flux-source-controller, zot, dagger, gitness, crossplane-provider-azure-sql, docker-cli-buildx, rclone, gomplate, gitlab-runner...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: nfpm, k9s, crossplane-provider-aws-ec2, vcluster, zarf, crossplane-provider-aws-firehose, gitsign, pulumi-language-dotnet, trivy, snyk-cli, flux-source-controller, zot, dagger, gitness, crossplane-provider-azure-sql, docker-cli-buildx, rclone, gomplate, gitlab-runner...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, boring-registry, src-fingerprint-fips, crossplane-provider-aws-kms, skaffold, gptscript, apko, crossplane-provider-aws-firehose, terragrunt, xeol, rclone, crossplane-provider-aws-sqs, crossplane-provider-azure-managedidentity, docker-fips, kot...

zot-registry-2.1.14-1.1 on GA media (moderate)

zot-registry-2.1.14-1.1 on GA media Announcement ID: openSUSE-SU-2026:10100-1 Rating: moderate Cross-References: CVE-2025-30204 CVSS scores: CVE-2025-30204 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-30204 SUSE : 8.7...

OPENSUSE-SU-2026:10100-1 zot-registry-2.1.14-1.1 on GA media

These are all security issues fixed in the zot-registry-2.1.14-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-39897

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...

EUVD-2025-16350

Malicious code in bioql PyPI...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: tflint, k9s, grype, tfsec, trivy-operator, conftest, steampipe, zarf, wolfictl, trivy, snyk-cli, terragrunt, zot, opentofu, syft, kubescape, rancher-fleet, terraform, kots, xeol...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: tflint, k9s, grype, tfsec, trivy-operator, conftest, steampipe, zarf, wolfictl, trivy, snyk-cli, terragrunt, zot, opentofu, syft, kubescape, rancher-fleet, terraform, kots, xeol...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: grype, k9s-fips, terraform-fips, k9s, xeol-fips, terragrunt, trivy-operator-fips, xeol, kots, steampipe, tfsec, kubescape, cloudbeat, opentofu-fips, cloudbeat-fips, trivy-fips, tflint, chainctl, conftest-fips, conftest, snyk-cli, grype-db, zot, rancher-fleet-fips,...

SUSE CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...