278 matches found
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: zot, mcp-grafana, kots, amazon-cloudwatch-agent, loki, distribution, tempo, opentofu, fluent-bit-plugin-loki, grafana-alloy, harbor-registry, pulumi-kubernetes-operator, grafana-mimir, falcosidekick, grafana-pyroscope, caddy, datadog-agent, aws-otel-collector, grafan...
GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...
CVE-2026-81871 vulnerabilities
Vulnerabilities for packages: frankenphp-8.3, grafana, aws-otel-collector, caddy-fips, grafana-alloy, mcp-grafana, opentofu-fips, amazon-cloudwatch-agent, datadog-agent-fips, grafana-pyroscope, loki, tempo-fips, grafana-fips, frankenphp-8.2, pulumi-kubernetes-operator, grafana-geomys-fips,...
GHSA-W34Q-CM8F-9C5X vulnerabilities
Vulnerabilities for packages: zot, mcp-grafana, kots, amazon-cloudwatch-agent, loki, distribution, tempo, opentofu, fluent-bit-plugin-loki, grafana-alloy, harbor-registry, pulumi-kubernetes-operator, grafana-mimir, falcosidekick, grafana-pyroscope, caddy, datadog-agent, aws-otel-collector, grafan...
CVE-2026-61833
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:16+00:00| published-proof-of-concept| https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25...
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
EUVD-2026-83187
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833
zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...
CLEANSTART-2026-NW72485 Security fix for CVE-2021-41190 applied in: docker 20.10.11-r0, docker-fips 20.10.11-r0, zot 2.1.13-r2
CVE-2021-41190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-HS45258 Security fix for GHSA-f2g3-hh2r-cwgc applied in: gitness 3.3.0-r2, zot 2.1.13-r2
GHSA-f2g3-hh2r-cwgc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-CX76698 Security fix for GHSA-6pjf-3r9x-m592 applied in: zot 2.1.13-r2
Security vulnerability affects the zot package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100309
Security vulnerability affects the zot package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95512
Name of the Vulnerable Software and Affected Versions zot versions prior to 2.1.18 Description A flaw in the bearer authentication handler allows a remote attacker with a token limited to pull and push actions to delete manifests and blobs within the token's repository scope. This occurs because...
CVE-2026-61833: Improper Authorization
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...