2 vulnerabilities across 2 products scored HIGH or above on November 11, 2026.

  • 🟠 HIGH: 2

🟠 [HIGH] apache_software_foundation/apache_roller

1 CVE | CVSS 3.1: 8.8 | AAS 10.1

  • cpe:2.3:a:apache:apache_roller:*:*:*:*:*:*:*:* (>= 5.0.1, < 6.1.7)

Apache Roller versions 5.0.1 through 6.1.6 are affected by a high-severity CSRF vulnerability (CVE-2026-118411, CVSS 8.8) that allows an unauthenticated attacker to create administrator accounts by tricking a logged-in admin into visiting a malicious link. The flaw exists because request-token validation was only enforced on POST requests while administrative actions also accepted GET requests, making CSRF trivially exploitable.

Organizations running Apache Roller for blog or content management should upgrade to version 6.1.7 or later immediately. The fix enforces POST method requirements and valid token checks for all state-changing actions. Given that exploitation requires only social engineering an admin click and grants full administrative access, this should be treated as a priority patch.

Vendor Advisory

🟠 [HIGH] red_hat/red_hat_quay_3

1 CVE | CVSS 3.1: 9.8 | AAS 9.9

  • cpe:2.3:a:redhat:red_hat_quay_3:*:*:*:*:*:*:*:* (>= 3.0.0)

Red Hat Quay 3 is affected by a critical-severity authentication bypass vulnerability (CVE-2026-123710, CVSS 9.8) that allows an unauthenticated attacker to exploit the service key rotation endpoint to install a persistent, non-expiring signing key. With that key in place, the attacker can forge registry tokens granting full read and write access to any repository, including private images and the ability to replace tags with malicious content.

Organizations using Red Hat Quay for container image registry services should review the vendor advisory immediately and apply patches or mitigations as they become available. Given the unauthenticated remote attack vector and the potential for complete registry compromise including supply chain poisoning through tag replacement, this vulnerability warrants urgent attention even in the absence of known known exploitation activity.

Vendor Advisory