GHSA-85JX-FM8M-X8C6 zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the tag already exists and reference != "latest". as a result, when latest already exists, a user who is allowed to create but not allowe...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801

Summary : CVE-2026-31801 affects zot, an OCI distribution registry, where the dist-spec authorization middleware misclassifies PUT /v2/{name}/manifests/{reference} as create and only switches to update when the tag exists and reference != "latest". As a result, a user allowed to create (but not u...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...

zot 安全漏洞

Zot is an open-source OCI image registry developed by The Zot Project. Versions 1.3.0 to 2.1.14 of Zot contain security vulnerabilities. These vulnerabilities stem from the improper operation inference of the dist-spec authorization middleware when handling PUT /v2/name/manifests/reference...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kaniko, metrics-server, rancher-system-agent, task-fips, longhorn-manager-fips, kube-vip-cloud-provider, kyverno-fips, terragrunt, kubescape-server, ferretdb, kubernetes-csi-external-snapshotter, flux-kustomize-controller-fips, cluster-api-azure-controller-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, docker, crossplane, pulumi, crossplane-provider-aws-sqs, gitsign, crossplane-provider-aws-eks, trufflehog, actions-runner-controller, crossplane-provider-aws-s3, grafana-alloy, aactl, crossplane-provider-aws-cloudformation, melange,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, docker, crossplane, pulumi, crossplane-provider-aws-sqs, gitsign, crossplane-provider-aws-eks, trufflehog, actions-runner-controller, crossplane-provider-aws-s3, grafana-alloy, aactl, crossplane-provider-aws-cloudformation, melange,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-rds, crossplane-provider-aws-dynamodb-fips, vcluster, gitness, crossplane-provider-aws-sns, grafana, flux-notification-controller, terragrunt-fips, xeol-fips, actions-runner-controller,...

zot-registry-2.1.14-1.1 on GA media (moderate)

zot-registry-2.1.14-1.1 on GA media Announcement ID: openSUSE-SU-2026:10100-1 Rating: moderate Cross-References: CVE-2025-30204 CVSS scores: CVE-2025-30204 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-30204 SUSE : 8.7...

OPENSUSE-SU-2026:10100-1 zot-registry-2.1.14-1.1 on GA media

These are all security issues fixed in the zot-registry-2.1.14-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-39897

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...

EUVD-2025-16350

Malicious code in bioql PyPI...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: trivy-operator, wolfictl, terragrunt, snyk-cli, k9s, conftest, xeol, grype, tflint, kots, trivy, kubescape, zarf, syft, opentofu, steampipe, terraform, tfsec, rancher-fleet, zot...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: trivy-operator, wolfictl, terragrunt, snyk-cli, k9s, conftest, xeol, grype, tflint, kots, trivy, kubescape, zarf, syft, opentofu, steampipe, terraform, tfsec, rancher-fleet, zot...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, steampipe, xeol-fips, rancher-fleet, grype-fips, opentofu, zot, terraform, conftest, terragrunt, grype, tflint, chainctl, trivy-operator-fips, tfsec, cloudbeat-fips, opentofu-fips, kots, trivy-operator, trivy, syft, zarf, k9s, xeol, k9s-fips,...

SUSE CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...