Red Hat Security AdvisoryRHSA-2026:6567
Red Hat Quay 3.16.3
Released 2026-04-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
Fixes 13 records
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority HIGH 71
Authlib is a Python library which builds OAuth and OpenID Connect servers.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00272 · Published 2026-01-08 · Partial fix · 1.6.6 CWE-352
Priority HIGH 69
Authlib is a Python library which builds OAuth and OpenID Connect servers.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.0024 · Published 2026-03-16 · Partial fix · 1.6.9 CWE-354
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00902 · Published 2026-02-05 · Partial fix · 1.24.13, 1.25.7 +1 CWE-295
Priority MEDIUM 45
Pillow is a Python imaging library.
CVSS 4.0HIGH 8.6· Local · No auth · No interaction · EPSS 0.00403 · Published 2026-02-11 · Partial fix · 12.1.1 CWE-787
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02759 · Published 2026-02-09 · Partial fix · 1.13.5, 0.30.3 CWE-754
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 41
pypdf is a free and open-source pure-python PDF library.
CVSS 4.0LOW 1.2· Network · No auth · User interaction · EPSS 0.00397 · Published 2026-02-25 · Partial fix · 6.7.2 CWE-835
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00384 · Published 2026-02-10 · Partial fix · 46.0.5 CWE-345
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00738 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
THREATIST.IORead the docs