RHEL 8 : pcp (RHSA-2026:55560)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55560 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet8.0: aspnetcore-runtime-8.0-8.0.30-0.1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-8.0-8.0.30-0.1.hum1 aarch64, x8664 aspnetcore-targeting-pack-8.0-8.0.30-0.1.hum1 aarch64, x8664...

RHSA-2026:55142 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:54869 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: helm3: helm3-3.21.4-0.1.hum1 aarch64, x8664 helm3-3.21.4-0.1.hum1.src src Security Fixes: helm3: CVE-2026-63308...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet10.0: aspnetcore-runtime-10.0-10.0.11-1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-10.0-10.0.11-1.hum1 aarch64, x8664 aspnetcore-targeting-pack-10.0-10.0.11-1.hum1 aarch64, x8664...

EUVD-2026-58822

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to...

EUVD-2026-58823

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

EUVD-2026-58821

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

EUVD-2026-58820

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

EUVD-2026-58817

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

EUVD-2026-58819

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

EUVD-2026-58818

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...

CVE-2026-74241

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...

CVE-2026-74245

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74247

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

CVE-2026-74243

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74247 Quay: ssrf via build archive_url in quay build api

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...