CVE Tools
Track your stack

Red Hat Quay 3

36 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Red Hat Quay 3, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Quay 3 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Quay 3 CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-031
2026-041
2026-052
2026-061
2026-072
2026-089
2026-093
2026-107
2026-110

Severity

How the 36 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High38%
  • Medium3083%
  • Low38%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Quay 3.

  1. CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers3.3
  2. CVE-2026-85471Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable6.4
  3. CVE-2026-109195Quay: repository auto-prune policy uuid idor in quay api3.1
  4. CVE-2026-109194Quay: build trigger uuid idor in quay api6.4
  5. CVE-2026-105447Quay: quay: global read-only superuser can access build trigger write credentials5.5
  6. CVE-2026-102576Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page4.2
  7. CVE-2026-102295Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter5.4
  8. CVE-2026-85469Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope8.0
  9. CVE-2026-79699Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory4.4
  10. CVE-2026-79705Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5
  11. CVE-2026-74247Quay: ssrf via build archive_url in quay build api4.2
  12. CVE-2026-74245Quay: unauthenticated exported logs download in quay5.9
  13. CVE-2026-74244Quay: stripe webhook accepts forged events without signature verification in quay5.9
  14. CVE-2026-74243Quay: unauthenticated secscan notification endpoint in quay when psk is unset6.5
  15. CVE-2026-74242Quay: repository notification uuid idor in quay api5.3

Product grouping is registry-driven, with AI assist and human review. How it works