CVE-2026-110697

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

UBUNTU-CVE-2026-110697

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

EUVD-2026-123611

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

CVE-2026-110697

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

CVE-2026-110697 Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

CVE-2026-110697

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

CVE-2026-110697: Project Quay, Red Hat: A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled…

A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their...

PT-2026-145285

Name of the Vulnerable Software and Affected Versions Quay affected versions not specified Description A flaw exists in the robot account listing function that constructs a SQL LIKE pattern using user-controlled namespace names without escaping wildcard metacharacters. An attacker can create a...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the CopyDelegateFile path in the VIDEO/APNG delegate code. An attacker can write output to a disallowed path by supplying a delegate-driven image write that copies a generated file to a destination the policy shou...

GIFLIB security vulnerability

GIFLIB is a library for reading and editing gif images. A security vulnerability exists in GIFLIB, which stems from a Segmentation Fault issue in getarg.c. The vulnerability is caused by the presence of a Segmentation Fault...

CVE-2022-31697

The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation Install/Upgrade/Migrate/Restore can access plaintext passwords used during that...

Moderate: Red Hat Security Advisory: openstack-cinder security and bug fix update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder PHP Connector exiftran Command Injection', 'Description' = %q This module exploits a command injection vulnerability in elFinder version...

elFinder PHP Connector < 2.1.48 - exiftran Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is...