Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 75
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.87286 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.82813 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 73
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.81556 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-06-11 · Partial fix · 1.15.2, 0.31.1 CWE-1321
Priority HIGH 67
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.59547 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 62
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.57461 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 58
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00186 · Published 2026-03-12 · Fix deferred CWE-601
Priority MEDIUM 55
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27004 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 54
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.25448 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 50
A directory traversal vulnerability was found in the ClairCore engine of Clair.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04815 · Published 2022-03-03 · Fixed in 0.4.8, 1.1.0 +1 CWE-22
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 45
A privilege escalation flaw was found in Podman.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04171 · Published 2022-04-29 · Partial fix · 3.4, 1.7.2 CWE-281
Priority MEDIUM 42
A flaw was found in Red Hat Quay.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-08-14 · Fix deferred CWE-306
Priority MEDIUM 41
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00537 · Published 2026-04-08 · Partial fix · 1782177012, 1779822261 +8 CWE-502
Priority MEDIUM 41
A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.0091 · Published 2021-05-27 · Fixed CWE-79
Priority MEDIUM 40
A flaw was found in python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04538 · Published 2022-09-09 · Partial fix CWE-704
Priority LOW 38
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0044 · Published 2020-01-21 · Will not fix CWE-352
Priority LOW 35
A flaw was found in Red Hat Quay.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0027 · Published 2026-04-22 · Fix deferred CWE-613
Priority LOW 33
A flaw was found in Red Hat Quay's exported logs feature.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00418 · Published 2026-08-14 · No fix listed CWE-306
Priority LOW 32
A flaw was found in Red Hat Quay's Stripe billing webhook handler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0023 · Published 2026-08-14 · Fix deferred CWE-347
Priority LOW 32
A flaw was found in Red Hat Quay's container image upload process.
CVSS 3.1HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00252 · Published 2026-04-08 · Partial fix · 1782177012, 1779822261 +6 CWE-639
Priority LOW 31
A flaw was found in Red Hat Quay.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00245 · Published 2026-08-14 · Fix deferred CWE-918
Priority LOW 30
A flaw was found in Quay.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00548 · Published 2023-11-07 · No fix listed CWE-1021
Priority LOW 30
A flaw was found in Keystone.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00719 · Published 2022-09-01 · No fix listed CWE-324
Load more
THREATIST.IORead the docs