72793 matches found
CVE-2026-74243
A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...
CVE-2026-74244
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...
CVE-2026-74242
Affects Red Hat Quay. The issue allows a repository administrator to read a notification’s configuration (including webhook URLs, Slack tokens, and email addresses) by knowing or guessing the target notification UUID, and to trigger test notifications for another repository. Root cause: unauthori...
CVE-2026-74242 Quay: repository notification uuid idor in quay api
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...
CVE-2026-74242
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...
CVE-2026-74243
A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...
CVE-2026-74241
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...
CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication
A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...
CVE-2026-74240
The CVE concerns Red Hat Quay’s JWT validation for federated robot accounts and SSO, where flawed audience verification and insufficient enforcement of azp and sub allow a token from the same identity provider to bypass security boundaries, potentially leading to unauthorized access where audienc...
CVE-2026-74240
A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...
CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication
A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...
CVE-2026-74242
A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...
CVE-2026-74241
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...
CVE-2026-74240
A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: expat: expat-2.8.3-0.1.hum1 aarch64, x8664 expat-devel-2.8.3-0.1.hum1 aarch64, x8664 expat-static-2.8.3-0.1.hum1 aarch64, x8664 expat-2.8.3-0.1.hum1.src src Security Fixes: expat: CVE-2026-72522...
RHSA-2026:54757 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory
Bulletin has no description...
RHSA-2026:54667 Red Hat Security Advisory: freerdp security update
Bulletin has no description...
RHSA-2026:54666 Red Hat Security Advisory: yelp security update
Bulletin has no description...