Companies/Red Hat (incl. Quay.io)/CVEs

Red Hat (incl. Quay.io) CVEs

15 vulnerabilities mapped to Red Hat (incl. Quay.io)’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-08-14

  CVE-2026-74247 Quay: ssrf via build archive_url in quay build api

  CVSS 4.2 mediumEPSS 0.25%

• 2026-08-14

  CVE-2026-74245 Quay: unauthenticated exported logs download in quay

  CVSS 5.9 mediumEPSS 0.42%

• 2026-08-14

  CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay

  CVSS 5.9 mediumEPSS 0.23%

• 2026-08-14

  CVE-2026-74243 Quay: unauthenticated secscan notification endpoint in quay when psk is unset

  CVSS 6.5 mediumEPSS 0.46%

• 2026-08-14

  CVE-2026-74242 Quay: repository notification uuid idor in quay api

  CVSS 5.3 mediumEPSS 0.33%

• 2026-08-14

  CVE-2026-74241 Quay: ldap referral filter injection in quay external ldap authentication

  CVSS 4.8 mediumEPSS 0.31%

• 2026-08-14

  CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication

  CVSS 5.4 mediumEPSS 0.29%

• 2026-06-11

  CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

  CVSS 7.0 highEPSS 0.85%

• 2026-04-22

  CVE-2026-6848 Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

  CVSS 5.4 mediumEPSS 0.27%

• 2026-04-08

  CVE-2026-32591 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

  CVSS 5.2 mediumEPSS 0.33%

• 2026-04-08

  CVE-2026-32590 Mirror-registry: remote code execution using pickle deserialization

  CVSS 7.1 highEPSS 0.52%

• 2026-04-08

  CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload

  CVSS 7.4 highEPSS 0.24%

• 2026-04-08

  CVE-2026-2377 Mirror-registry: quay: quay: server-side request forgery via log export functionality

  CVSS 6.5 mediumEPSS 0.41%

• 2026-03-12

  CVE-2026-2376 Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

  CVSS 4.9 mediumEPSS 0.16%

• 2025-05-06

  CVE-2025-4374 Quay: incorrect privilege assignment

  CVSS 6.5 mediumEPSS 0.34%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)