Red hat quay 3

This hub aggregates every CVE we track for Red hat quay 3, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat quay 3.

• CVE-2026-85469Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope8.0Sep 16, 2026
• CVE-2026-79699Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory4.4Sep 15, 2026
• CVE-2026-79705Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5Sep 15, 2026
• CVE-2026-74247Quay: ssrf via build archive_url in quay build api4.2Aug 14, 2026
• CVE-2026-74245Quay: unauthenticated exported logs download in quay5.9Aug 14, 2026
• CVE-2026-74243Quay: unauthenticated secscan notification endpoint in quay when psk is unset6.5Aug 14, 2026
• CVE-2026-74244Quay: stripe webhook accepts forged events without signature verification in quay5.9Aug 14, 2026
• CVE-2026-74242Quay: repository notification uuid idor in quay api5.3Aug 14, 2026
• CVE-2026-74241Quay: ldap referral filter injection in quay external ldap authentication4.8Aug 14, 2026
• CVE-2026-74240Quay: jwt claim validation bypasses in quay federated robot and sso authentication5.4Aug 14, 2026
• CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives4.2Aug 13, 2026
• CVE-2026-19519Claircore: claircore: denial of service via unchecked type assertion in rpm header parser4.3Aug 11, 2026
• CVE-2026-16910Quay: ssrf in red hat quay notification webhooks (slack/generic)5.5Jul 24, 2026
• CVE-2026-16254Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser4.3Jul 20, 2026
• CVE-2026-11569Quay: quay: stored xss via filedrop svg upload5.4Jun 8, 2026