TI-2026-22305 CVE-2026-27962 · GHSA-wvwj-cvrp-7pv5
Authlib JWS JWK Header Injection: Signature Verification Bypass
Priority HIGH 80
Authlib is a Python library which builds OAuth and OpenID Connect servers.
RHSA-2026:48085
Red Hat Quay 3.18.0
Released 2026-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-rhel9
Fixes 10 records
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-25101 CVE-2026-32590 · GHSA-mvqc-wfv6-7764
Mirror-registry: remote code execution using pickle deserialization
Priority MEDIUM 41
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-23219 CVE-2026-29074 · GHSA-xpqw-6gx7-v673
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Priority MEDIUM 40
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4
pyOpenSSL DTLS cookie callback buffer overflow
Priority LOW 35
pyOpenSSL is a Python wrapper around the OpenSSL library.
TI-2026-51293 CVE-2026-73086 · GHSA-xwg4-73v4-xw9w
nanoid: Integer Overflow or Wraparound
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.
TI-2026-25102 CVE-2026-32591 · GHSA-9wjq-f6rc-86wf
Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
Priority LOW 25
A flaw was found in Red Hat Quay's Proxy Cache configuration feature.