Important: Red Hat Security Advisory: Red Hat Quay 3.9.20

🗓️ 07 Apr 2026 21:36:48Reported by RedHatType

redhat🔗 access.redhat.com👁 14 Views

Red Hat Quay 3.9.20 is now available with bug fixes.

Reporter	Title	Published	Views	Family All 1014
vulnersOsv	@343dev/optimizt (>=12.0.0, <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360, <=0.0.1774152861718) +37 more potentially affected by CVE-2026-29074 via svgo (4.0.0-rc.0)	4 Mar 202622:59	–	vulnersosv
vulnersOsv	5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0, <=2.8.0)	4 Mar 202622:59	–	vulnersosv
vulnersOsv	@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +652 more potentially affected by CVE-2026-29063 via immutable (>=4.0.0, <=4.3.7)	4 Mar 202621:28	–	vulnersosv
vulnersOsv	org.webjars.npm:cssnano (5.1.14), org.webjars.npm:cssnano-preset-default (5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (2.8.0)	4 Mar 202622:59	–	vulnersosv
vulnersOsv	@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +129 more potentially affected by CVE-2026-29063 via immutable (>=5.0.0, <=5.1.4)	4 Mar 202621:28	–	vulnersosv
vulnersOsv	-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +11040 more potentially affected by CVE-2026-29063 via immutable (>=3.0.1, <=3.8.2)	4 Mar 202621:28	–	vulnersosv
vulnersOsv	@0x5e/react-native-alipay (>=0.2.2, <=0.2.7-beta.2), @10yun/cv-mobile-ui (0.3.20) +1791 more potentially affected by CVE-2026-4599 via jsrsasign (>=7.1.2, <=11.1.0)	17 Feb 202609:02	–	vulnersosv
vulnersOsv	@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4601 via jsrsasign (>=11.0.0, <=11.1.0)	23 Mar 202606:30	–	vulnersosv
vulnersOsv	@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4602 via jsrsasign (>=11.0.0, <=11.1.0)	23 Mar 202606:30	–	vulnersosv
vulnersOsv	org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4600 via org.webjars.npm:jsrsasign (11.1.0)	16 Feb 202605:02	–	vulnersosv

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-29063
access	www.access.redhat.com/security/cve/CVE-2026-29074
access	www.access.redhat.com/security/cve/CVE-2026-30922
access	www.access.redhat.com/security/cve/CVE-2026-32597
access	www.access.redhat.com/security/cve/CVE-2026-4599
access	www.access.redhat.com/security/cve/CVE-2026-4600
access	www.access.redhat.com/security/cve/CVE-2026-4601
access	www.access.redhat.com/security/cve/CVE-2026-4602
access	www.access.redhat.com/security/updates/classification/

16 Sep 2026 14:11Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.1 - 9.8

CVSS 49.4

EPSS0.00978

SSVC

Red Hat Quay Quay version 3.9.20 Bug fixes