https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:05:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380655 EUVD-2026-380655 https://cve.radiocsirt.org/vuln/euvd-2026-380655 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18255 <p>A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.</p> <p>A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18255 https://cve.radiocsirt.org/vuln/ghsa-x8x8-qp2x-c2mj <p>A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.</p> <p>A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.</p> https://cve.radiocsirt.org/vuln/ghsa-x8x8-qp2x-c2mj https://cve.radiocsirt.org/vuln/rhsa-2026:63307 <p>quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation quay: quay: Global read-only superuser can view robot account tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input podman: Podman: Information disclosure via malicious container image environment variables js-yaml: js-yaml: Denial of Service via crafted YAML documents nanoid: nanoid: Denial of Service via negative size input in non-secure module functions axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter axios: axios: Denial of Service via object serialization bypass brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL nanoid: nanoid: Predictable ID generation due to integer overflow browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results</p> <p>quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation quay: quay: Global read-only superuser can view robot account tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input podman: Podman: Information disclosure via malicious container image environment variables js-yaml: js-yaml: Denial of Service via crafted YAML documents nanoid: nanoid: Denial of Service via negative size input in non-secure module functions axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter axios: axios: Denial of Service via object serialization bypass brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL nanoid: nanoid: Predictable ID generation due to integer overflow browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results</p> https://cve.radiocsirt.org/vuln/rhsa-2026:63307 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2576 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Quay ausnutzen, um Informationen offenzulegen, die zur Darstellung als bestimmte Konten verwendet werden können.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Quay ausnutzen, um Informationen offenzulegen, die zur Darstellung als bestimmte Konten verwendet werden können.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2576