Red Hat Red Hat Satellite 6.16 for RHEL 9

• CVE-2026-56098 Medium 4.3 Rubygem-katello: improper authorization logic allows resource enumeration 0.3%
• CVE-2026-56097 Medium 6.5 Rubygem-katello: sql injection in registry proxy via labels 0.3%
• CVE-2026-12542 Medium 5.3 Foreman: command injection in foreman-tail 0.6%
• CVE-2026-12545 Medium 6.7 Rubygem-hammer_cli: command injection via insecure editor invocation 0.5%
• CVE-2026-96658 High 8.8 Foreman: foreman: arbitrary code execution via safemode sandbox bypass 0.7%
• CVE-2026-96659 Critical 9.1 Foreman: excessive permissions for viewer role on preview 0.3%
• CVE-2026-12544 High 7.7 Foreman: ssti and insecure deserialization in foreman-rake configuration 0.2%
• CVE-2026-12541 High 8.2 Foreman: command injection in foreman-rake database tasks 1.2%
• CVE-2026-12540 High 8.2 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter 1.2%
• CVE-2026-12423 High 7.5 Foreman: unauthenticated information disclosure via provisioning token validation flaw 0.4%
• CVE-2026-12405 High 8.8 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter 1.6%
• CVE-2026-79654 Medium 4.3 Ketello: katello content view history api cross-organization authorization bypass 0.4%
• CVE-2026-12701 Critical 9.0 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport 1.2%
• CVE-2026-5138 Medium 4.3 Foreman: foreman: information disclosure via improper validation of nested request parameters 0.4%
• CVE-2026-5135 Medium 6.5 Foreman: foreman: unauthorized modification of host configurations via broken access control 0.4%
• CVE-2026-5142 Medium 6.5 Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass 0.4%
• CVE-2026-5136 High 8.8 Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation 0.6%
• CVE-2026-12515 Medium 4.3 Katello: missing repository authorization in content_uploads exposes cross-product content existence 0.2%
• CVE-2026-1961 High 8.0 Forman: foreman: remote code execution via command injection in websocket proxy 1.9%
• CVE-2025-10990 High 7.5 Rexml: rexml: denial of service via inefficient regex parsing 0.5%
• CVE-2026-0980 High 8.3 Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username 0.9%
• CVE-2025-9572 Medium 5.0 Foreman: satellite: graphql api permission bypass leads to information disclosure 0.4%
• CVE-2026-1530 High 8.1 Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation 0.3%
• CVE-2026-1531 High 8.1 Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification 0.3%
• CVE-2025-10622 High 8.0 Foreman: os command injection via ct_location and fcct_location parameters 0.7%
• CVE-2024-8553 Medium 6.3 Foreman: read-only access to entire db from templates 0.4%
• CVE-2024-7923 Critical 9.8 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore 0.8%
• CVE-2024-7012 Critical 9.8 Puppet-foreman: an authentication bypass vulnerability exists in foreman 0.8%