Theforeman vulnerabilities

Products

• Foreman 86
• Katello 10
• Foreman Ansible 2
• Hammer Cli 2

Newest

• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-tail CVE-2026-12542 5.3 MediumOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: excessive permissions for viewer role on preview CVE-2026-96659 9.1 CriticalOctober 1, 2026
• theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: foreman: arbitrary code execution via safemode sandbox bypass CVE-2026-96658 8.8 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: ssti and insecure deserialization in foreman-rake configuration CVE-2026-12544 7.7 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake database tasks CVE-2026-12541 8.2 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter CVE-2026-12540 8.2 HighOctober 1, 2026
• redhat satellite, theforeman foreman, red hat satellite 6 +5 more +7 more Foreman: unauthenticated information disclosure via provisioning token validation flaw CVE-2026-12423 7.5 HighOctober 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup CVE-2026-81658 6.5 MediumAugust 27, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: information disclosure via improper validation of nested request parameters CVE-2026-5138 4.3 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: unauthorized modification of host configurations via broken access control CVE-2026-5135 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass CVE-2026-5142 6.5 MediumJuly 1, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 more Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation CVE-2026-5136 8.8 HighJuly 1, 2026
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config CVE-2026-13316 4.4 MediumJune 30, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: insecure sensitive http header sanitization CVE-2026-9073 6.2 MediumJune 23, 2026
• theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 more Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse CVE-2026-12112 7.8 HighJune 23, 2026
• theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +4 more +6 more Forman: foreman: remote code execution via command injection in websocket proxy CVE-2026-1961 Public exploit 8.0 HighMarch 26, 2026
• redhat satellite, the foreman foreman, red hat satellite 6.15 for rhel 8 +6 more +8 more Foreman: satellite: graphql api permission bypass leads to information disclosure CVE-2025-9572 Fix available 5.0 MediumNovember 21, 2025
• theforeman foreman, red hat satellite 6 +1 more Foreman: command injection in "host init config" template via "install packages" field on foreman CVE-2024-7700 6.5 MediumAugust 12, 2024
• theforeman foreman, red hat satellite 6.13 for rhel 8, satellite 6.14 for rhel 8 +1 more +3 more Foreman: world readable file containing secrets CVE-2023-4886 6.7 MediumOctober 3, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Os command injection via ct_command and fcct_command CVE-2022-3874 8.0 HighSeptember 22, 2023
• theforeman foreman, red hat satellite 6, redhat satellite +2 more Arbitrary code execution through yaml global parameters CVE-2023-0462 8.0 HighSeptember 20, 2023
• theforeman foreman, red hat satellite 6.11 for rhel 7, satellite 6.11 for rhel 8 +4 more +6 more Foreman: arbitrary code execution through templates CVE-2023-0118 9.1 CriticalSeptember 20, 2023
• the foreman foreman A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the... CVE-2021-20260 7.8 HighAugust 26, 2022
• the foreman foreman, redhat satellite +1 more A flaw was found in Foreman project. A credential leak was identified which will expose Azure... CVE-2021-3590 8.8 HighAugust 22, 2022
• theforeman foreman A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat... CVE-2020-10710 Fix available 4.4 MediumAugust 16, 2022
• theforeman smart proxy salt An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy... CVE-2021-3456 Public exploit 7.1 HighMarch 30, 2022
• theforeman openscap An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart... CVE-2021-20290 6.1 MediumMarch 25, 2022
• theforeman foreman ansible, redhat satellite +1 more Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589 Fix available 8.0 HighMarch 23, 2022
• the foreman foreman, redhat satellite +1 more A server side remote code execution vulnerability was found in Foreman project. A authenticated... CVE-2021-3584 7.2 HighDecember 23, 2021
• the foreman foreman, theforeman foremanfogproxmox +1 more Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-20259 Fix available 7.8 HighJune 7, 2021
• the foreman foreman Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling... CVE-2021-3469 5.4 MediumJune 3, 2021
• redhat satellite, satellite capsule, theforeman foreman ansible +2 more A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not... CVE-2020-10716 6.5 MediumMay 27, 2021
• theforeman smart proxy shell hooks An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart... CVE-2021-3457 6.1 MediumMay 12, 2021
• the foreman foreman A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by... CVE-2021-3494 5.9 MediumApril 26, 2021
• [unknown] satellite, theforeman foreman azurerm +1 more A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A... CVE-2021-3413 6.3 MediumApril 8, 2021
• redhat satellite, rubygem-hammer cli foreman cli foreman, theforeman hammer cli +2 more rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable CVE-2014-0241 5.5 MediumDecember 13, 2019
• foreman Foreman has improper input validation which could lead to partial Denial of Service CVE-2014-0091 5.3 MediumDecember 11, 2019
• katello Katello has a Denial of Service vulnerability in API OAuth authentication CVE-2013-4120 7.5 HighDecember 10, 2019
• katello Katello: Username in Notification page has cross site scripting CVE-2013-0283 5.4 MediumDecember 5, 2019
• katello, redhat satellite +1 more Katello has multiple XSS issues in various entities CVE-2013-2101 5.4 MediumDecember 3, 2019
• red hat katello Katello cleartext password storage issue CVE-2019-14825 Fix available 4.1 MediumNovember 25, 2019
• redhat satellite, the foreman foreman +1 more It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce... CVE-2014-8183 7.4 HighAugust 1, 2019
• the foreman project foreman-tasks, redhat satellite +1 more An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously,... CVE-2019-10198 6.5 MediumJuly 31, 2019
• the foreman foreman, redhat satellite +1 more In Foreman it was discovered that the delete compute resource operation, when executed from the... CVE-2019-3893 4.9 MediumApril 9, 2019
• red hat katello, redhat satellite +1 more katello Cross-site Scripting vulnerability CVE-2018-16887 Fix available 5.4 MediumJanuary 13, 2019
• red hat katello katello SQL Injection vulnerability CVE-2018-14623 4.3 MediumDecember 13, 2018
• the foreman foreman A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker... CVE-2018-16861 7.6 HighDecember 7, 2018
• [unknown] foreman A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability... CVE-2018-14664 5.4 MediumOctober 12, 2018
• theforeman foreman, [unknown] smart proxy dynflow +1 more smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature CVE-2018-14643 Fix available 9.8 CriticalSeptember 21, 2018
• foreman foreman before version 1.15.0 is vulnerable to an information leak through organizations and... CVE-2016-7078 4.3 MediumSeptember 10, 2018
• Show olderLoading…