Red Hat Satellite 6.16 for RHEL 9 vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest Red Hat Satellite 6.16 for RHEL 9 vulnerabilities

CVE-2026-56098 — Rubygem-katello: improper authorization logic allows resource enumeration (CVSS 4.3)
CVE-2026-56097 — Rubygem-katello: sql injection in registry proxy via labels (CVSS 6.5)
CVE-2026-12545 — Rubygem-hammer_cli: command injection via insecure editor invocation (CVSS 6.7)
CVE-2026-12405 — Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter (CVSS 8.8)
CVE-2026-79654 — Ketello: katello content view history api cross-organization authorization bypass (CVSS 4.3)
CVE-2026-12701 — Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport (CVSS 9.0)
CVE-2026-12515 — Katello: missing repository authorization in content_uploads exposes cross-product content existence (CVSS 4.3)
CVE-2025-10990 — Rexml: rexml: denial of service via inefficient regex parsing (CVSS 7.5)
CVE-2026-1531 — Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification (CVSS 8.1)
CVE-2026-1530 — Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation (CVSS 8.1)
CVE-2025-10622 — Foreman: os command injection via ct_location and fcct_location parameters (CVSS 8.0)
CVE-2024-8553 — Foreman: read-only access to entire db from templates (CVSS 6.3)