CVE-2026-63209 vulnerabilities

Vulnerabilities for packages: k3d, reports-server, aactl, prometheus, containerd, zitadel, zot, kyverno, commercial-kyverno, prometheus-mongodb-exporter, upwind-agent, commercial-expanso-edge, terraform, snyk-cli, cert-manager, kine, nerdctl, falco-no-driver, kots, flux, prometheus-operator,...

CVE-2026-63209 vulnerabilities

Vulnerabilities for packages: kine, prometheus-operator, helm, spire-server, k3d, kaf, kyverno, nerdctl, k3s, minio, loki, zot, kots, containerd, flux, falco-no-driver, telegraf, snyk-cli, aactl...

GHSA-VWCJ-R8V9-P53F vulnerabilities

Vulnerabilities for packages: kine, prometheus-operator, hugo-extended, helm, spire-server, k6, kaf, kyverno, opentelemetry-collector, hugo, nerdctl, external-dns, k3s, vale, fuse-overlayfs-snapshotter, minio, mailpit, caddy, hubble, gitea, rclone, loki, cilium-cli, wuzz, zot, kubernetes,...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: datadog-agent, grafana, mcp-grafana, distribution, harbor-registry, tempo, amazon-cloudwatch-agent, aws-otel-collector, traefik, caddy, loki, grafana-pyroscope, zot, grafana-mimir, kots, fluent-bit-plugin-loki, grafana-alloy, opentofu, falcosidekick,...

GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, amazon-cloudwatch-agent-fips, elastic-agent, envoy-ai-gateway, frankenphp-8.4, dynatrace-operator-fips, grafana-pyroscope, caddy-fips, opentofu, zitadel, zot, harbor-registry, grafana-mimir-fips, caddy, falcosidekick-fips, grafana-fips,...

GHSA-W34Q-CM8F-9C5X vulnerabilities

Vulnerabilities for packages: datadog-agent, grafana, mcp-grafana, distribution, harbor-registry, tempo, amazon-cloudwatch-agent, aws-otel-collector, traefik, caddy, loki, grafana-pyroscope, zot, grafana-mimir, kots, fluent-bit-plugin-loki, grafana-alloy, opentofu, falcosidekick,...

CVE-2026-61833

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:16+00:00| published-proof-of-concept| https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25...

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...

GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...

EUVD-2026-83187

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833

zot , an OCI Distribution Specification-based container image registry, is affected in versions prior to 2.1.18 by an authorization flaw. The bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the "push" action, so DELETE requests are never checked...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CLEANSTART-2026-NW72485 Security fix for CVE-2021-41190 applied in: docker 20.10.11-r0, docker-fips 20.10.11-r0, zot 2.1.13-r2

CVE-2021-41190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HS45258 Security fix for GHSA-f2g3-hh2r-cwgc applied in: gitness 3.3.0-r2, zot 2.1.13-r2

GHSA-f2g3-hh2r-cwgc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CX76698 Security fix for GHSA-6pjf-3r9x-m592 applied in: zot 2.1.13-r2

Security vulnerability affects the zot package. This issue is resolved in later releases. See references for vulnerability details...