CVE-2026-102576

MediumCVSS 4.2/10Last modified Oct 6, 2026

Description

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1025774.3A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authe CVE-2026-1025788.8A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly int CVE-2026-1025794.3A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile informa CVE-2026-102586.3A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_top CVE-2026-1025804.3A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component CVE-2026-1025815.4A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS CVE-2026-1025824.3A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, al CVE-2026-1025832.7A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servic CVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe CVE-2026-1025854.3A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the CVE-2026-1025866.1A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cro CVE-2026-1025872.7A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user wit