270 matches found
GO-2026-6508 vulnerabilities
Vulnerabilities for packages: falcosidekick, pulumi-kubernetes-operator, loki, datadog-agent, opentofu, zot, mcp-grafana, grafana, grafana-pyroscope, aws-otel-collector, caddy, harbor-registry, kots, amazon-cloudwatch-agent, grafana-mimir, fluent-bit-plugin-loki, distribution, grafana-alloy, temp...
CVE-2026-81871 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, amazon-cloudwatch-agent, distribution-fips, elastic-agent, tempo, elastic-agent-fips, frankenphp-8.5, opentofu, datadog-agent-fips, commercial-grafana, terraform, grafana-pyroscope, dynatrace-operator, datadog-agent, grafana-mimir-fips,...
GHSA-W34Q-CM8F-9C5X vulnerabilities
Vulnerabilities for packages: falcosidekick, pulumi-kubernetes-operator, loki, datadog-agent, opentofu, zot, mcp-grafana, grafana, grafana-pyroscope, aws-otel-collector, caddy, harbor-registry, kots, amazon-cloudwatch-agent, grafana-mimir, fluent-bit-plugin-loki, distribution, grafana-alloy, temp...
CVE-2026-61833
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:16+00:00| published-proof-of-concept| https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25...
CVE-2026-61833
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
EUVD-2026-83187
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
CVE-2026-61833
zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...
CLEANSTART-2026-NW72485 Security fix for CVE-2021-41190 applied in: docker 20.10.11-r0, docker-fips 20.10.11-r0, zot 2.1.13-r2
CVE-2021-41190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-61833: Improper Authorization
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...
GO-2026-4942 vulnerabilities
Vulnerabilities for packages: gitness, portieris, argocd-image-updater, kots, zot, envoy-gateway...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-attacher, cert-manager-istio-csr, cilium, rancher-system-agent, cass-operator, kuma, azure-service-operator, cloud-provider-gcp-cloud-controller-manager, pulumi-kubernetes-operator, rke2-cloud-provider, fluent-operator, emissary,...
GO-2025-3409 vulnerabilities
Vulnerabilities for packages: zot...
GO-2023-1832 vulnerabilities
Vulnerabilities for packages: zot...