Vulnerabilities in project-zot

5 results

CVE-2026-61833HIGHzot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionEPSS 0.8%CVE-2025-23208HIGHIdP group membership revocation ignored in zotEPSS 0.4%CVE-2024-39897MEDIUMCache driver GetBlob() allows read access to any blob without access control checkEPSS 0.3%CVE-2026-31801HIGHzot create-only policy allows overwrite attempts of existing latest tag (update permission not required)EPSS 0.2%CVE-2025-48374MEDIUMzot logs secretsEPSS 0.2%