Openshift Update Service (Redhat) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-14. Vendor: Redhat.
CVEs of Openshift Update Service
- CVE-2026-74247 - CVSS 7.1 (high), 2026-08-14: A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF)…
- CVE-2026-74245 - CVSS 7.5 (high), 2026-08-14: A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper…
- CVE-2026-74244 - CVSS 7.5 (high), 2026-08-14: A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending…
- CVE-2026-74243 - CVSS 8.2 (high), 2026-08-14: A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to…
- CVE-2026-74242 - CVSS 5.3 (medium), 2026-08-14: A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can…
- CVE-2026-74241 - CVSS 6.5 (medium), 2026-08-14: A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during…
- CVE-2026-74240 - CVSS 5.4 (medium), 2026-08-14: A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues…
- CVE-2026-16910 - CVSS 5.5 (medium), 2026-07-24: A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF…
- CVE-2026-7598 - CVSS 9.1 (critical), 2026-05-01: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such…
- CVE-2025-57854 - CVSS 6.4 (medium), 2026-04-08: A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created…
- CVE-2026-31812 - CVSS 8.7 (high), 2026-03-10: Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a…
- CVE-2026-3338 - CVSS 8.7 (high), 2026-03-02: Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with…
- CVE-2026-3336 - CVSS 8.7 (high), 2026-03-02: Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7…
- CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
