Red Hat Red Hat Satellite 6.16 for RHEL 9
28 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-56098 | corrigé en 0:4.14.0.23-1.el9sat | Rubygem-katello: improper authorization logic allows resource enumeration | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-56097 | corrigé en 0:4.14.0.23-1.el9sat | Rubygem-katello: sql injection in registry proxy via labels | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-12545 | corrigé en 0:3.12.0-2.el9sat | Rubygem-hammer_cli: command injection via insecure editor invocation | MEDIUM 6.7 | 0.5 % | ||
| CVE-2026-12542 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: command injection in foreman-tail | HIGH 7.8 | 0.6 % | ||
| CVE-2026-96659 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: excessive permissions for viewer role on preview | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-96658 | corrigé en 0:1.5.0-2.el9sat | Foreman: foreman: arbitrary code execution via safemode sandbox bypass | HIGH 8.8 | 0.7 % | ||
| CVE-2026-12544 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: ssti and insecure deserialization in foreman-rake configuration | HIGH 7.7 | 0.2 % | ||
| CVE-2026-12541 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: command injection in foreman-rake database tasks | HIGH 8.2 | 1.2 % | ||
| CVE-2026-12540 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter | HIGH 8.2 | 1.2 % | ||
| CVE-2026-12423 | corrigé en 0:3.12.0.23-1.el9sat | Foreman: unauthenticated information disclosure via provisioning token validation flaw | HIGH 7.5 | 0.4 % | ||
| CVE-2026-12405 | corrigé en 0:13.2.8-2.el9sat | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter | HIGH 8.8 | 1.6 % | ||
| CVE-2026-79654 | corrigé en 0:4.14.0.23-1.el9sat | Ketello: katello content view history api cross-organization authorization bypass | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-12701 | | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-5138 | corrigé en 0:3.12.0.17-1.el9sat | Foreman: foreman: information disclosure via improper validation of nested request parameters | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-5135 | corrigé en 0:3.12.0.17-1.el9sat | Foreman: foreman: unauthorized modification of host configurations via broken access control | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-5142 | corrigé en 0:3.12.0.17-1.el9sat | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-5136 | corrigé en 0:3.12.0.17-1.el9sat | Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation | HIGH 8.8 | 0.6 % | ||
| CVE-2026-12515 | corrigé en 0:4.14.0.21-1.el9sat | Katello: missing repository authorization in content_uploads exposes cross-product content existence | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-1961 | corrigé en 0:3.12.0.14-1.el9sat | Forman: foreman: remote code execution via command injection in websocket proxy | HIGH 8.8 | 1.9 % | ||
| CVE-2025-10990 | corrigé en 0:8.8.1-3.el9sat | Rexml: rexml: denial of service via inefficient regex parsing | HIGH 7.5 | 0.5 % | ||
| CVE-2026-0980 | corrigé en 0:0.13.0-0.1.el9sat | Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username | HIGH 8.8 | 0.9 % | ||
| CVE-2025-9572 | | Foreman: satellite: graphql api permission bypass leads to information disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-1530 | corrigé en 0:1.5.1-1.el9sat | Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-1531 | corrigé en 0:0.2.0-2.el9sat | Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification | HIGH 8.1 | 0.3 % | ||
| CVE-2025-10622 | corrigé en 0:3.12.0.11-1.el9sat | Foreman: os command injection via ct_location and fcct_location parameters | HIGH 8.0 | 0.7 % | ||
| CVE-2024-8553 | | Foreman: read-only access to entire db from templates | MEDIUM 6.3 | 0.4 % | ||
| CVE-2024-7923 | | Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-7012 | | Puppet-foreman: an authentication bypass vulnerability exists in foreman | CRITICAL 9.8 | 0.8 % |