What’s Vulnerable › Products

project-zot zot vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your project-zot zot version is affected

Latest project-zot zot vulnerabilities

• CVE-2026-61833 — zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion (CVSS 8.1)
• CVE-2026-31801 — zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) (CVSS 7.7)
• CVE-2025-48374 — zot logs secrets (CVSS 5.5)
• CVE-2025-23208 — IdP group membership revocation ignored in zot (CVSS 5.3)
• CVE-2024-39897 — Cache driver GetBlob() allows read access to any blob without access control check (CVSS 4.3)