Red Hat Quay 3.14 vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

RH

Product

Red Hat Quay 3.14

by Red Hat · last CVE Jul 29, 2026

21

CVEs

0

On KEV

10.0

Max CVSS

0

New 30D

Vulnerabilities21 In the news0 Timeline

Severity mix

Critical 6High 10Medium 4Low 1

Severity

All severities21 Critical6 High10 Medium4 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Red Hat Quay 3.14 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-32590	8.8	1%	Apr 8	Mirror-registry: remote code execution using pickle deserialization Affected: All versions, or not specified
CVE-2026-42039	7.5	1%	Apr 24	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data Affected: All versions, or not specified
CVE-2026-40895	7.5	0%	Apr 21	follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets Affected: All versions, or not specified
CVE-2026-40192	7.5	1%	Apr 15	Pillow is vulnerable to a FITS GZIP decompression bomb Affected: All versions, or not specified
CVE-2026-33894	7.5	0%	Mar 27	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field Affected: All versions, or not specified
CVE-2026-32286	7.5	1%	Mar 26	Denial of service in github.com/jackc/pgproto3/v2 Affected: All versions, or not specified
CVE-2026-29074	7.5	1%	Mar 6	SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) Affected: All versions, or not specified
CVE-2026-42033	7.4	1%	Apr 24	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking Affected: All versions, or not specified
CVE-2026-32589	7.4	0%	Apr 8	Mirror-registry: quay: insecure direct object reference in blobupload Affected: All versions, or not specified
CVE-2026-18255	7.2	1%	Jul 29	Quay: quay: global read-only superuser can view robot account tokens Affected: All versions, or not specified