CVE-2026-15927

CVE-2026-15927: Red Hat Quay repository-level mirror feature allows SSRF via external_reference in POST/PUT to endpoints/api/mirror.py, not applying the stricter validate_external_registry_url() used by organization-level mirrors. This enables a repository administrator to craft a hostname that m...

CVE-2026-48501: Incorrect Authorization

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

PT-2026-3903

Name of the Vulnerable Software and Affected Versions go-tuf versions 2.0.0 through 2.3.0 Description go-tuf, a Go implementation of The Update Framework TUF, is susceptible to a denial of service. When processing TUF metadata, versions prior to 2.3.1 may panic if invalid JSON is received from th...