Product by Red Hat
Red Hat Satellite 6.16 For Rhel 9
28 known vulnerabilities in Red Hat Satellite 6.16 For Rhel 9 (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-12405 | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter | 8.8 | |
| High | CVE-2026-12541 | Foreman: command injection in foreman-rake database tasks | 8.2 | |
| High | CVE-2026-12540 | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter | 8.2 | |
| High | CVE-2026-1961 | Forman: foreman: remote code execution via command injection in websocket proxy | 8.0 | |
| Critical | CVE-2026-12701 | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | 9.0 | |
| High | CVE-2026-96658 | Foreman: foreman: arbitrary code execution via safemode sandbox bypass | 8.8 | |
| High | CVE-2026-0980 | Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username | 8.3 | |
| Critical | CVE-2026-96659 | Foreman: excessive permissions for viewer role on preview | 9.1 | |
| Critical | CVE-2024-7923 | Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore | 9.8 | |
| High | CVE-2026-5136 | Red Hat Satellite: Incorrect Privilege Assignment | 8.8 | |
| Critical | CVE-2024-7012 | Puppet-foreman: an authentication bypass vulnerability exists in foreman | 9.8 | |
| Medium | CVE-2026-12545 | Rubygem-hammer_cli: command injection via insecure editor invocation | 6.7 | |
| High | CVE-2025-10622 | Foreman: os command injection via ct_location and fcct_location parameters | 8.0 | |
| High | CVE-2026-12423 | Foreman: unauthenticated information disclosure via provisioning token validation flaw | 7.5 | |
| High | CVE-2026-12542 | Foreman: command injection in foreman-tail | 5.3 | |
| High | CVE-2026-12544 | Foreman: ssti and insecure deserialization in foreman-rake configuration | 7.7 | |
| High | CVE-2025-10990 | Rexml: rexml: denial of service via inefficient regex parsing | 7.5 | |
| Medium | CVE-2026-56097 | Rubygem-katello: sql injection in registry proxy via labels | 6.5 | |
| Medium | CVE-2026-5142 | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass | 6.5 | |
| Medium | CVE-2026-5135 | Foreman: foreman: unauthorized modification of host configurations via broken access control | 6.5 | |
| High | CVE-2026-1531 | Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification | 8.1 | |
| High | CVE-2026-1530 | Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation | 8.1 | |
| Medium | CVE-2026-56098 | Rubygem-katello: improper authorization logic allows resource enumeration | 4.3 | |
| Medium | CVE-2026-79654 | Ketello: katello content view history api cross-organization authorization bypass | 4.3 | |
| Medium | CVE-2024-8553 | Foreman: read-only access to entire db from templates | 6.3 |