https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-31801.htmlhttps://patchthecve.com/cve/CVE-2026-31801.htmlWed, 17 Jun 2026 10:34:29 +0000HIGH 7.7: zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the https://patchthecve.com/cve/CVE-2025-23208.htmlhttps://patchthecve.com/cve/CVE-2025-23208.htmlWed, 17 Jun 2026 08:52:39 +0000HIGH 7.3: zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. Thhttps://patchthecve.com/cve/CVE-2024-39897.htmlhttps://patchthecve.com/cve/CVE-2024-39897.htmlWed, 17 Jun 2026 07:42:59 +0000MEDIUM 4.3: zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If a Zot `accessControl` policy allows users read access to some repositories but restricts read access to other repositories and `dedupe` is enabled (it is enabled