Quay: ldap referral filter injection in quay external ldap authentication

Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

Quay: build trigger uuid idor in quay api

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

React Router vulnerable to XSS via Open Redirects

Quay: quay: global read-only superuser can access build trigger write credentials

Quay: ssrf in red hat quay notification webhooks (slack/generic)

Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

Quay: jwt claim validation bypasses in quay federated robot and sso authentication

Quay: quay: stored xss via filedrop svg upload

Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Quay: repository notification uuid idor in quay api

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints