Skip to contentRed Hat Quay 3 vulnerabilities
- red hat mirror registry for red hat openshift 2, quay 3 +1 moreQuay: quay: reflected xss via image_id in v1 registry error responsesCVE-2026-1288245.4 Medium
- project quay quay, red hat mirror registry for red hat openshift 2, quay 3.10 +8 more +10 moreQuay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokensCVE-2026-110697Public exploit9.9 Critical
- project quay quay, red hat mirror registry for red hat openshift 2, quay 3.10 +8 more +10 moreQuay: red hat quay: unauthenticated registry signing-key takeover via service key rotationCVE-2026-1237109.8 Critical
- red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 morePodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layersCVE-2026-1142363.3 Low
- red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2, quay 3 +2 moreQuay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassableCVE-2026-854716.4 Medium
- red hat quay 3Quay: repository auto-prune policy uuid idor in quay apiCVE-2026-1091953.1 Low
- red hat quay 3Quay: build trigger uuid idor in quay apiCVE-2026-1091946.4 Medium
- red hat quay 3Quay: quay: global read-only superuser can access build trigger write credentialsCVE-2026-1054475.5 Medium
- red hat quay 3Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin pageCVE-2026-1025764.2 Medium
- red hat quay 3Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameterCVE-2026-1022955.4 Medium
- red hat quay 3Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scopeCVE-2026-854698.0 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +6 more +8 morePodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryCVE-2026-79699Fix available4.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callersCVE-2026-79705Fix available4.5 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ssrf via build archive_url in quay build apiCVE-2026-742474.2 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated exported logs download in quayCVE-2026-742455.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: stripe webhook accepts forged events without signature verification in quayCVE-2026-742445.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated secscan notification endpoint in quay when psk is unsetCVE-2026-742436.5 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: repository notification uuid idor in quay apiCVE-2026-742425.3 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: ldap referral filter injection in quay external ldap authenticationCVE-2026-742414.8 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: jwt claim validation bypasses in quay federated robot and sso authenticationCVE-2026-742405.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesCVE-2026-19730Fix available4.2 Medium
- red hat advanced cluster security 4, quay 3 +1 moreClaircore: claircore: denial of service via unchecked type assertion in rpm header parserCVE-2026-195194.3 Medium
- red hat quay 3.10, quay 3.12, quay 3.14 +5 more +7 moreQuay: quay: global read-only superuser can view robot account tokensCVE-2026-182557.2 High
- red hat openshift update service, quay 3 +1 moreQuay: ssrf in red hat quay notification webhooks (slack/generic)CVE-2026-169105.5 Medium
- red hat mirror registry for red hat openshift 2, quay 3.10, quay 3.12 +5 more +7 moreQuay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validationCVE-2026-159276.8 Medium
- red hat advanced cluster security 4, quay 3 +1 moreClaircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parserCVE-2026-162544.3 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- dana powers kafka-python, red hat quay 3.10, quay 3.12 +3 more +5 morekafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.pyCVE-2026-10143Fix available8.7 High
- red hat quay 3Quay: quay: stored xss via filedrop svg uploadCVE-2026-115695.4 Medium
- axios, red hat cryostat 4, gatekeeper 3 +62 more +64 moreAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44496Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axiosCVE-2026-44488Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-44486Fix available7.5 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVE-2026-44492Fix availableEPSS 12.3%8.6 High
- red hat quay 3Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystringCVE-2026-100782.7 Low
- red hat quay 3Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpointsCVE-2026-100524.1 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48526Fix available7.4 High
- pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 morepip can extract console_scripts and gui_scripts outside installation directoryCVE-2026-8643Fix available4.1 Medium
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CVE-2026-9277Public exploitFix available9.2 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 moreInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshCVE-2026-46595Public exploitFix available10.0 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsCVE-2026-42508Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshCVE-2026-39835Fix available5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 moreInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentCVE-2026-39832Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 moreInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshCVE-2026-39830Fix available9.1 Critical
- Show moreLoading…