TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:22629
Red Hat Quay 3.12.18
Released 2026-06-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
Fixes 17 records
TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-29006 CVE-2026-40192 · GHSA-whj4-6x5x-4v2j
Pillow is vulnerable to a FITS GZIP decompression bomb
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-25101 CVE-2026-32590 · GHSA-mvqc-wfv6-7764
Mirror-registry: remote code execution using pickle deserialization
Priority MEDIUM 41
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm
Inefficient policy validation in crypto/x509
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
TI-2026-28770 CVE-2026-39892 · GHSA-p423-j2cm-9vmq
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Priority LOW 38
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2026-25100 CVE-2026-32589 · GHSA-7fjh-cgxv-cjc6
Mirror-registry: quay: insecure direct object reference in blobupload
Priority LOW 32
A flaw was found in Red Hat Quay's container image upload process.
TI-2026-29551 CVE-2026-40895
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
Priority LOW 30
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.
TI-2026-02012 CVE-2026-2377 · GHSA-2c4x-699h-vw5x
Mirror-registry: quay: quay: server-side request forgery via log export functionality
Priority LOW 29
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift.