agentprime: red-hat-quay-3

agentprime: red-hat-quay-3Every new CVE for red-hat-quay-3.https://agentprime.io/CVE-2026-85471: Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassablehttps://agentprime.io/advisories/CVE-2026-85471/https://agentprime.io/advisories/CVE-2026-85471/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 18:50:20 GMTCVECVE-2026-109195: Quay: repository auto-prune policy uuid idor in quay apihttps://agentprime.io/advisories/CVE-2026-109195/https://agentprime.io/advisories/CVE-2026-109195/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 15:27:03 GMTCVECVE-2026-109194: Quay: build trigger uuid idor in quay apihttps://agentprime.io/advisories/CVE-2026-109194/https://agentprime.io/advisories/CVE-2026-109194/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 15:27:03 GMTCVECVE-2026-105447: Quay: quay: global read-only superuser can access build trigger write credentialshttps://agentprime.io/advisories/CVE-2026-105447/https://agentprime.io/advisories/CVE-2026-105447/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 20:29:45 GMTCVECVE-2026-102576: Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin pagehttps://agentprime.io/advisories/CVE-2026-102576/https://agentprime.io/advisories/CVE-2026-102576/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:02:51 GMTCVECVE-2026-102295: Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameterhttps://agentprime.io/advisories/CVE-2026-102295/https://agentprime.io/advisories/CVE-2026-102295/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:02:45 GMTCVECVE-2026-85469: Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scopehttps://agentprime.io/advisories/CVE-2026-85469/https://agentprime.io/advisories/CVE-2026-85469/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 21:02:29 GMTCVECVE-2026-79699: Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryhttps://agentprime.io/advisories/CVE-2026-79699/https://agentprime.io/advisories/CVE-2026-79699/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:25:16 GMTCVECVE-2026-79705: Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callershttps://agentprime.io/advisories/CVE-2026-79705/https://agentprime.io/advisories/CVE-2026-79705/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:23:26 GMTCVECVE-2026-74247: Quay: ssrf via build archive_url in quay build apihttps://agentprime.io/advisories/CVE-2026-74247/https://agentprime.io/advisories/CVE-2026-74247/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:15 GMTCVECVE-2026-74245: Quay: unauthenticated exported logs download in quayhttps://agentprime.io/advisories/CVE-2026-74245/https://agentprime.io/advisories/CVE-2026-74245/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:10 GMTCVECVE-2026-74244: Quay: stripe webhook accepts forged events without signature verification in quayhttps://agentprime.io/advisories/CVE-2026-74244/https://agentprime.io/advisories/CVE-2026-74244/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:06 GMTCVECVE-2026-74243: Quay: unauthenticated secscan notification endpoint in quay when psk is unsethttps://agentprime.io/advisories/CVE-2026-74243/https://agentprime.io/advisories/CVE-2026-74243/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:06 GMTCVECVE-2026-74242: Quay: repository notification uuid idor in quay apihttps://agentprime.io/advisories/CVE-2026-74242/https://agentprime.io/advisories/CVE-2026-74242/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:04 GMTCVECVE-2026-74241: Quay: ldap referral filter injection in quay external ldap authenticationhttps://agentprime.io/advisories/CVE-2026-74241/https://agentprime.io/advisories/CVE-2026-74241/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:02 GMTCVECVE-2026-74240: Quay: jwt claim validation bypasses in quay federated robot and sso authenticationhttps://agentprime.io/advisories/CVE-2026-74240/https://agentprime.io/advisories/CVE-2026-74240/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 22:43:01 GMTCVECVE-2026-19519: Claircore: claircore: denial of service via unchecked type assertion in rpm header parserhttps://agentprime.io/advisories/CVE-2026-19519/https://agentprime.io/advisories/CVE-2026-19519/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 07:39:56 GMTCVECVE-2026-16910: Quay: ssrf in red hat quay notification webhooks (slack/generic)https://agentprime.io/advisories/CVE-2026-16910/https://agentprime.io/advisories/CVE-2026-16910/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Jul 2026 06:36:18 GMTCVECVE-2026-16254: Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parserhttps://agentprime.io/advisories/CVE-2026-16254/https://agentprime.io/advisories/CVE-2026-16254/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 10:42:02 GMTCVECVE-2026-11569: Quay: quay: stored xss via filedrop svg uploadhttps://agentprime.io/advisories/CVE-2026-11569/https://agentprime.io/advisories/CVE-2026-11569/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 08 Jun 2026 10:54:40 GMTCVECVE-2026-10078: Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystringhttps://agentprime.io/advisories/CVE-2026-10078/https://agentprime.io/advisories/CVE-2026-10078/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 09:30:30 GMTCVECVE-2026-10052: Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpointshttps://agentprime.io/advisories/CVE-2026-10052/https://agentprime.io/advisories/CVE-2026-10052/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 07:59:20 GMTCVECVE-2026-6848: Quay: red hat quay: authentication bypass allows privileged actions without valid credentialshttps://agentprime.io/advisories/CVE-2026-6848/https://agentprime.io/advisories/CVE-2026-6848/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 09:06:19 GMTCVECVE-2026-2376: Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interfacehttps://agentprime.io/advisories/CVE-2026-2376/https://agentprime.io/advisories/CVE-2026-2376/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Mar 2026 19:11:16 GMTCVECVE-2025-4374: Quay: incorrect privilege assignmenthttps://agentprime.io/advisories/CVE-2025-4374/https://agentprime.io/advisories/CVE-2025-4374/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 May 2025 14:49:28 GMTCVECVE-2024-9683: Quay: quay allows successful authentication with trucated version of the passwordhttps://agentprime.io/advisories/CVE-2024-9683/https://agentprime.io/advisories/CVE-2024-9683/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Oct 2024 14:08:57 GMTCVECVE-2024-5891: Quay: unauthorized user may authenticate via oauth application tokenhttps://agentprime.io/advisories/CVE-2024-5891/https://agentprime.io/advisories/CVE-2024-5891/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Jun 2024 13:16:54 GMTCVECVE-2023-4956: Quay: clickjacking on config-editor page severityhttps://agentprime.io/advisories/CVE-2023-4956/https://agentprime.io/advisories/CVE-2023-4956/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2023 19:12:00 GMTCVECVE-2023-4959: Quay: cross-site request forgery (csrf) on config-editor pagehttps://agentprime.io/advisories/CVE-2023-4959/https://agentprime.io/advisories/CVE-2023-4959/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Sep 2023 09:51:26 GMTCVECVE-2023-3384: Quay: stored cross site scriptinghttps://agentprime.io/advisories/CVE-2023-3384/https://agentprime.io/advisories/CVE-2023-3384/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Jul 2023 15:19:20 GMTCVE