What’s Vulnerable › Products

Red Hat Satellite 6 vulnerabilities

277 known vulnerabilities, 5 confirmed exploited in the wild (CISA KEV), 55 published in the last 12 months.

Check whether your Red Hat Satellite 6 version is affected

Exploited Red Hat Satellite 6 vulnerabilities

• CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling Vulnerability
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
• CVE-2016-3427 — Oracle Java SE and JRockit Unspecified Vulnerability
• CVE-2015-4902 — Oracle Java SE Integrity Check Vulnerability
• CVE-2015-2590 — Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

Latest Red Hat Satellite 6 vulnerabilities

• CVE-2026-107203 — Foreman: domain and subnet interface api skips host search filters (CVSS 5.4)
• CVE-2026-107193 — Foreman: api filter lookup ignores a search-limited filter permission (CVSS 6.5)
• CVE-2026-89091 — Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution (CVSS 8.8)
• CVE-2026-107445 — Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass (CVSS 5.4)
• CVE-2026-107444 — Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass (CVSS 4.3)
• CVE-2026-107151 — Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests (CVSS 5.9)
• CVE-2026-103870 — Pulp-rpm: distribution tree publish creates directories from .treeinfo ids (CVSS 5.0)
• CVE-2026-103869 — Pulp-ansible: bearer tokens are reused across remotes in a worker (CVSS 6.5)
• CVE-2026-103868 — Pulp-container: registry credentials are reused across remotes in a worker (CVSS 6.5)
• CVE-2026-106471 — Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching (CVSS 8.1)
• CVE-2026-56098 — Rubygem-katello: improper authorization logic allows resource enumeration (CVSS 4.3)
• CVE-2026-56097 — Rubygem-katello: sql injection in registry proxy via labels (CVSS 6.5)
• CVE-2026-12545 — Rubygem-hammer_cli: command injection via insecure editor invocation (CVSS 6.7)
• CVE-2026-12542 — Foreman: command injection in foreman-tail (CVSS 7.8)
• CVE-2026-96659 — Foreman: excessive permissions for viewer role on preview (CVSS 9.1)
• CVE-2026-96658 — Foreman: foreman: arbitrary code execution via safemode sandbox bypass (CVSS 8.8)
• CVE-2026-12544 — Foreman: ssti and insecure deserialization in foreman-rake configuration (CVSS 7.7)
• CVE-2026-12541 — Foreman: command injection in foreman-rake database tasks (CVSS 8.2)
• CVE-2026-12540 — Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVSS 8.2)
• CVE-2026-12423 — Foreman: unauthenticated information disclosure via provisioning token validation flaw (CVSS 7.5)
• CVE-2026-12405 — Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter (CVSS 8.8)
• CVE-2026-90959 — Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft (CVSS 8.1)
• CVE-2026-92904 — Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check (CVSS 4.3)
• CVE-2026-92893 — Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters (CVSS 4.3)
• CVE-2026-92894 — Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction (CVSS 4.3)