https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:20:41.607849+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-31801 CVE-2026-31801 — zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) 2026-10-07T18:20:41.624204+00:00

Affected: project-zot zot

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.