Red Hat Security AdvisoryRHSA-2026:4215
Red Hat Quay 3.14.6
Released 2026-03-10 · Red Hat rating Important · View on Red Hat →
Fixes 21 records
Priority HIGH 73
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.01592 · Published 2025-05-17 · Partial fix · 78.1.1 CWE-22
Priority HIGH 72
Authlib is a Python library which builds OAuth and OpenID Connect servers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00275 · Published 2025-09-22 · Fixed in 1.6.4 CWE-345
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01196 · Published 2025-09-12 · Partial fix · 1.12.0, 0.30.2 CWE-770
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.0035 · Published 2026-01-22 · Partial fix · 0.46.2 CWE-22
Priority MEDIUM 55
Azure Storage Library Information Disclosure Vulnerability
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.00532 · Published 2022-07-12 · Fixed in 12.13.0, 12.18.0 +2 CWE-327
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.02922 · Published 2026-01-07 · Partial fix · 2.6.3 CWE-409
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-770
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01127 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-409
Priority MEDIUM 40
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00668 · Published 2025-11-13 · Partial fix · 0.43.0 CWE-617
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00226 · Published 2025-12-04 · Partial fix · 1.8.3 CWE-405
Priority LOW 38
auth0/node-jws is a JSON Web Signature implementation for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00231 · Published 2025-12-04 · Partial fix · 3.2.3, 4.0.1 CWE-347
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.
CVSS 4.0HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00801 · Published 2025-11-06 · Partial fix · 1.2.8, 1.13.0 +2 CWE-363
Priority LOW 34
Authlib is a Python library which builds OAuth and OpenID Connect servers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00638 · Published 2025-10-10 · Fixed in 1.6.5 CWE-20
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 30
pyjwt v2.10.1 was discovered to contain weak encryption.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00195 · Published 2025-07-31 · Fixed CWE-311
Priority LOW 28
urllib3 is a user-friendly HTTP client library for Python.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00474 · Published 2025-06-19 · Partial fix · 2.5.0 CWE-601
Priority LOW 26
Requests is a HTTP library.
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.01022 · Published 2025-06-09 · Partial fix · 2.32.4 CWE-522
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs