Quay: unauthenticated secscan notification endpoint in quay when psk is unset

Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

Quay: unauthenticated exported logs download in quay

Quay: stripe webhook accepts forged events without signature verification in quay

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Forge has signature forgery in Ed25519 due to missing S > L check

Denial of service in github.com/jackc/pgproto3/v2

Quay: ssrf via build archive_url in quay build api