TI-2026-52033 CVE-2026-74247 · GHSA-rg7f-fcx2-cjw3
Quay: ssrf via build archive_url in quay build api
Priority LOW 31
A flaw was found in Red Hat Quay.
Vulnerabilities
40 records
TI-2026-52032 CVE-2026-74245 · GHSA-jr6g-vw27-98vc
Quay: unauthenticated exported logs download in quay
Priority LOW 33
A flaw was found in Red Hat Quay's exported logs feature.
TI-2026-52031 CVE-2026-74244 · GHSA-fgq8-mwjv-6335
Quay: stripe webhook accepts forged events without signature verification in quay
Priority LOW 32
A flaw was found in Red Hat Quay's Stripe billing webhook handler.
TI-2026-52030 CVE-2026-74243 · GHSA-vxqv-j38r-6jmm
Quay: unauthenticated secscan notification endpoint in quay when psk is unset
Priority MEDIUM 42
A flaw was found in Red Hat Quay.
TI-2026-52029 CVE-2026-74242 · GHSA-9hvx-vhh3-2359
Quay: repository notification uuid idor in quay api
Priority LOW 24
A flaw was found in Red Hat Quay.
TI-2026-52028 CVE-2026-74241 · GHSA-x5cw-v6mp-3p93
Quay: ldap referral filter injection in quay external ldap authentication
Priority LOW 29
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling.
TI-2026-52027 CVE-2026-74240 · GHSA-3vf7-35c7-wgcv
Quay: jwt claim validation bypasses in quay federated robot and sso authentication
Priority LOW 24
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-06007 CVE-2026-6848 · GHSA-fwq2-5p9g-fm29
Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
Priority LOW 35
A flaw was found in Red Hat Quay.
TI-2026-25102 CVE-2026-32591 · GHSA-9wjq-f6rc-86wf
Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
Priority LOW 25
A flaw was found in Red Hat Quay's Proxy Cache configuration feature.
TI-2026-25101 CVE-2026-32590 · GHSA-mvqc-wfv6-7764
Mirror-registry: remote code execution using pickle deserialization
Priority MEDIUM 41
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads.
TI-2026-25100 CVE-2026-32589 · GHSA-7fjh-cgxv-cjc6
Mirror-registry: quay: insecure direct object reference in blobupload
Priority LOW 32
A flaw was found in Red Hat Quay's container image upload process.
TI-2026-02012 CVE-2026-2377 · GHSA-2c4x-699h-vw5x
Mirror-registry: quay: quay: server-side request forgery via log export functionality
Priority LOW 29
A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift.
TI-2026-02011 CVE-2026-2376 · GHSA-9w78-x9jw-9c7m
Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
Priority MEDIUM 58
A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing malicious web addresses.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2025-03902 CVE-2025-4374 · GHSA-f5vq-pq35-3qqc
Quay: incorrect privilege assignment
Priority LOW 29
A flaw was found in Quay.
TI-2024-08984 CVE-2024-9683 · GHSA-cj3p-4jrq-mg7x
Quay: quay allows successful authentication with trucated version of the password
Priority LOW 24
A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided.
TI-2024-05462 CVE-2024-5891 · GHSA-qwvx-pmh3-3mjv
Quay: unauthorized user may authenticate via oauth application token
Priority LOW 19
A vulnerability was found in Quay.
TI-2023-04561 CVE-2023-4956 · GHSA-xcx8-f2f5-h74f
Quay: clickjacking on config-editor page severity
Priority LOW 30
A flaw was found in Quay.
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
TI-2023-04564 CVE-2023-4959 · GHSA-xphq-2g8c-mfh6
Quay: cross-site request forgery (csrf) on config-editor page
Priority LOW 29
A flaw was found in Quay.
TI-2023-03164 CVE-2023-3384 · GHSA-jgpj-6chm-qj8q
Quay: stored cross site scripting
Priority LOW 25
A flaw was found in the Quay registry.
TI-2020-08634 CVE-2020-10735 · GHSA-6jr7-xr67-mgxw
Incorrect type conversion in python
Priority MEDIUM 40
A flaw was found in python.
TI-2022-02260 CVE-2022-2447 · GHSA-r88f-774m-5rj4
A flaw was found in Keystone.
Priority LOW 30
A flaw was found in Keystone.
TI-2022-01114 CVE-2022-1227 · GHSA-66vw-v2x9-hw75
Improper privilege management in psgo
Priority MEDIUM 45
A privilege escalation flaw was found in Podman.