Red Hat Satellite 6.19 For Rhel 9 vulnerabilities

11 CVEs affecting Red Hat Satellite 6.19 For Rhel 9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56098, published 2026-10-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12405, published 2026-10-01. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user…
CVE-2026-12701, published 2026-07-20. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-12545, published 2026-10-01. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation…
CVE-2026-4324, published 2026-03-17. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands…
CVE-2026-79654, published 2026-08-26. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to…
CVE-2026-56098, published 2026-10-01. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While…
CVE-2026-56097, published 2026-10-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries…
CVE-2026-12515, published 2026-06-17. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products…
CVE-2026-11332, published 2026-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument…

Latest

CVE-2026-16493, published 2026-07-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator…