Advisories · Technology
Red Hat Satellite 6.19 for RHEL 9.
Every CVE that names Red Hat Satellite 6.19 for RHEL 9 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Rubygem-katello: improper authorization logic allows resource enumeration
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Information disclosure
- CVSS 6.5 Medium
Rubygem-katello: sql injection in registry proxy via labels
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- SQL injection
- CVSS 5.3 Medium
Foreman: command injection in foreman-tail
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Command injection
- CVSS 6.7 Medium
Rubygem-hammer_cli: command injection via insecure editor invocation
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Command injection
- CVSS 8.8 High
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Foreman: excessive permissions for viewer role on preview
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Privilege escalation
- CVSS 7.7 High
Foreman: ssti and insecure deserialization in foreman-rake configuration
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Insecure deserialization
- CVSS 8.2 High
Foreman: command injection in foreman-rake database tasks
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Command injection
- CVSS 8.2 High
Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Command injection
- CVSS 7.5 High
Foreman: unauthenticated information disclosure via provisioning token validation flaw
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Authentication bypass
- CVSS 8.8 High
Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Command injection
- CVSS 4.3 Medium
Ketello: katello content view history api cross-organization authorization bypass
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Broken access control
- CVSS 7.8 High
Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Command injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Path traversal
- CVSS 4.3 Medium
Foreman: foreman: information disclosure via improper validation of nested request parameters
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Broken access control
- CVSS 6.5 Medium
Foreman: foreman: unauthorized modification of host configurations via broken access control
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Broken access control
- CVSS 6.5 Medium
Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Broken access control
- CVSS 8.8 High
Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Privilege escalation