Product by Red Hat

    Quay

    23 known vulnerabilities in Quay (Red Hat), 1 of them actively exploited (CISA KEV).

    Key figures

    23

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Quay (Red Hat)
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 161 other products

    		7.5
    CriticalCVE-2026-29063

    Immutable-js: Prototype Pollution

    also in 26 other products

    		9.8
    HighCVE-2026-18255

    Quay: quay: global read-only superuser can view robot account tokens

    also in 8 other products

    		7.2
    HighCVE-2026-74243

    Quay: unauthenticated secscan notification endpoint in quay when psk is unset

    also in 4 other products

    		6.5
    HighCVE-2026-32590

    Mirror-registry: remote code execution using pickle deserialization

    also in 11 other products

    		7.1
    HighCVE-2026-74245

    Quay: unauthenticated exported logs download in quay

    also in 4 other products

    		5.9
    MediumCVE-2026-2377

    Mirror-registry: quay: quay: server-side request forgery via log export functionality

    also in 10 other products

    		6.5
    MediumCVE-2026-74242

    Quay: repository notification uuid idor in quay api

    also in 4 other products

    		5.3
    HighCVE-2026-32589

    Mirror-registry: quay: insecure direct object reference in blobupload

    also in 10 other products

    		7.4
    HighCVE-2026-74244

    Quay: stripe webhook accepts forged events without signature verification in quay

    also in 4 other products

    		5.9
    MediumCVE-2026-74240

    Quay: jwt claim validation bypasses in quay federated robot and sso authentication

    also in 4 other products

    		5.4
    MediumCVE-2023-4956

    Quay: clickjacking on config-editor page severity

    also in 2 other products

    		6.5
    MediumCVE-2026-74241

    Quay: ldap referral filter injection in quay external ldap authentication

    also in 4 other products

    		4.8
    MediumCVE-2025-4374

    Quay: incorrect privilege assignment

    also in 2 other products

    		6.5
    MediumCVE-2026-32591

    Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

    also in 12 other products

    		5.2
    HighCVE-2026-6848

    Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

    also in 2 other products

    		5.4
    HighCVE-2026-74247

    Quay: ssrf via build archive_url in quay build api

    also in 4 other products

    		4.2
    MediumCVE-2023-3384

    Quay: stored cross site scripting

    also in 2 other products

    		5.4
    MediumCVE-2023-4959

    Quay: cross-site request forgery (csrf) on config-editor page

    also in 2 other products

    		6.5
    MediumCVE-2026-2376

    Red Hat mirror registry for Red Hat OpenShift: Open Redirect

    also in 5 other products

    		4.9
    HighCVE-2019-3864

    Red Hat Quay: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		5.4
    MediumCVE-2024-9683

    Quay: quay allows successful authentication with trucated version of the password

    also in 2 other products

    		4.8
    MediumCVE-2024-5891

    Quay: unauthorized user may authenticate via oauth application token

    also in 2 other products

    		4.2

    All products by Red Hat