Red Hat Quay 3.16 vulnerabilities

6 CVEs affecting Red Hat Quay 3.16, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18255, published 2026-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-18255, published 2026-07-29. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only…
CVE-2026-44990, published 2026-06-12. Critical severity, CVSS 9.3. EPSS: 0.7% chance of exploitation in the next 30 days. ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html`…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-15927, published 2026-07-21. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation,…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…