https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-74247.htmlhttps://patchthecve.com/cve/CVE-2026-74247.htmlThu, 20 Aug 2026 19:59:12 +0000MEDIUM 4.2: A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network https://patchthecve.com/cve/CVE-2026-74245.htmlhttps://patchthecve.com/cve/CVE-2026-74245.htmlThu, 20 Aug 2026 20:05:07 +0000MEDIUM 5.9: A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to infohttps://patchthecve.com/cve/CVE-2026-74244.htmlhttps://patchthecve.com/cve/CVE-2026-74244.htmlThu, 20 Aug 2026 20:01:38 +0000MEDIUM 5.9: A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to thehttps://patchthecve.com/cve/CVE-2026-74243.htmlhttps://patchthecve.com/cve/CVE-2026-74243.htmlThu, 20 Aug 2026 19:49:07 +0000MEDIUM 6.5: A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Chttps://patchthecve.com/cve/CVE-2026-74242.htmlhttps://patchthecve.com/cve/CVE-2026-74242.htmlThu, 20 Aug 2026 19:00:11 +0000MEDIUM 5.3: A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability alshttps://patchthecve.com/cve/CVE-2026-74241.htmlhttps://patchthecve.com/cve/CVE-2026-74241.htmlThu, 20 Aug 2026 19:13:47 +0000MEDIUM 4.8: A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling ushttps://patchthecve.com/cve/CVE-2026-74240.htmlhttps://patchthecve.com/cve/CVE-2026-74240.htmlThu, 20 Aug 2026 19:45:42 +0000MEDIUM 5.4: A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-