Redhat Quay vulnerabilities

• redhat quay, red hat openshift update service, quay 3 +2 more Quay: ssrf via build archive_url in quay build api CVE-2026-74247 4.2 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: unauthenticated exported logs download in quay CVE-2026-74245 5.9 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: stripe webhook accepts forged events without signature verification in quay CVE-2026-74244 5.9 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: unauthenticated secscan notification endpoint in quay when psk is unset CVE-2026-74243 6.5 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: repository notification uuid idor in quay api CVE-2026-74242 5.3 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: ldap referral filter injection in quay external ldap authentication CVE-2026-74241 4.8 MediumAugust 14, 2026
• redhat quay, red hat openshift update service, quay 3 +2 more Quay: jwt claim validation bypasses in quay federated robot and sso authentication CVE-2026-74240 5.4 MediumAugust 14, 2026
• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• redhat quay, red hat quay 3 +1 more Quay: red hat quay: authentication bypass allows privileged actions without valid credentials CVE-2026-6848 5.4 MediumApril 22, 2026
• redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +8 more +10 more Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration CVE-2026-32591 5.2 MediumApril 8, 2026
• redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +8 more +10 more Mirror-registry: remote code execution using pickle deserialization CVE-2026-32590 7.1 HighApril 8, 2026
• redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +7 more +9 more Mirror-registry: quay: insecure direct object reference in blobupload CVE-2026-32589 7.4 HighApril 8, 2026
• red hat mirror registry for red hat openshift, redhat quay, red hat mirror registry for red hat openshift 2 +6 more +8 more Mirror-registry: quay: quay: server-side request forgery via log export functionality CVE-2026-2377 6.5 MediumApril 8, 2026
• redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +2 more +4 more Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface CVE-2026-2376 4.9 MediumMarch 12, 2026
• immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 more Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVE-2026-29063 Fix available 8.7 HighMarch 4, 2026
• project quay quay, red hat quay 3 +1 more Quay: incorrect privilege assignment CVE-2025-4374 6.5 MediumMay 6, 2025
• redhat quay, red hat quay 3 +1 more Quay: quay allows successful authentication with trucated version of the password CVE-2024-9683 4.8 MediumOctober 17, 2024
• redhat quay, red hat quay 3 +1 more Quay: unauthorized user may authenticate via oauth application token CVE-2024-5891 4.2 MediumJune 12, 2024
• redhat quay, red hat quay 3 +1 more Quay: clickjacking on config-editor page severity CVE-2023-4956 6.5 MediumNovember 7, 2023
• redhat quay, red hat quay 3 +1 more Quay: cross-site request forgery (csrf) on config-editor page CVE-2023-4959 6.5 MediumSeptember 15, 2023
• redhat quay, red hat quay 3 +1 more Quay: stored cross site scripting CVE-2023-3384 5.4 MediumJuly 24, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• python, fedoraproject fedora, redhat enterprise linux +5 more +7 more A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases,... CVE-2020-10735 Fix available 7.5 HighSeptember 9, 2022
• openstack keystone, [unknown] openstack-keystone, redhat openstack platform +2 more +4 more A flaw was found in OpenStack. The application credential tokens can be used even after they have... CVE-2022-2447 Fix available 6.6 MediumSeptember 1, 2022
• podman project podman, fedoraproject fedora, psgo project psgo +13 more +15 more Podman publishes a malicious image to public registries CVE-2022-1227 Public exploitFix available 8.8 HighApril 29, 2022
• redhat clair, quay +1 more Path traversal in claircore CVE-2021-3762 Fix available 9.8 CriticalMarch 3, 2022
• project quay quay A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS)... CVE-2020-27832 9.0 CriticalMay 27, 2021
• project quay quay A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when... CVE-2020-27831 4.3 MediumMay 26, 2021
• project quay quay A vulnerability was found in the Quay web application. Sessions in the Quay web application never... CVE-2019-3867 4.1 MediumMarch 18, 2021
• project quay quay An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This... CVE-2020-14313 4.3 MediumAugust 11, 2020
• [unknown] quay A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super... CVE-2019-3865 4.7 MediumJune 22, 2020
• project quay quay A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI... CVE-2019-3864 5.4 MediumJanuary 21, 2020
• project quay quay A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker... CVE-2019-10205 6.0 MediumJanuary 2, 2020
• apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 more Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service CVE-2019-9518 Fix available EPSS 25.4% 7.5 HighAugust 13, 2019
• apache http server, traffic server, apple swiftnio +20 more +22 more Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service CVE-2019-9517 Fix available EPSS 27.0% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 more Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service CVE-2019-9516 Fix available EPSS 57.5% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 more Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service CVE-2019-9515 Fix available EPSS 87.3% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 more Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service CVE-2019-9514 Fix available EPSS 82.8% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service CVE-2019-9513 Public exploitFix available EPSS 81.6% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service CVE-2019-9511 Public exploitFix available EPSS 59.5% 7.5 HighAugust 13, 2019