Mirror-registry: remote code execution using pickle deserialization

A privilege escalation flaw was found in Podman

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token

Quay: unauthenticated secscan notification endpoint in quay when psk is unset

Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Quay: unauthenticated exported logs download in quay

Quay: stripe webhook accepts forged events without signature verification in quay

A flaw was found in python

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Mirror-registry: quay: insecure direct object reference in blobupload

Quay: ssrf via build archive_url in quay build api