TI-2026-01620 CVE-2026-1961 · GHSA-fh2w-2c26-vpg5
Forman: foreman: remote code execution via command injection in websocket proxy
Priority HIGH 73
A flaw was found in Foreman.
RHSA-2026:5968
Satellite 6.18.4 Async Update
Released 2026-03-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.18 for RHEL 9 foreman-3.16.0.12-1.el9sat, foreman-cli-3.16.0.12-1.el9sat, foreman-debug-3.16.0.12-1.el9sat +15
Fixes 7 records
TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm
Unexpected session resumption in crypto/tls
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4
Memory exhaustion in query parameter parsing in net/url
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
TI-2026-00742 CVE-2026-0980 · GHSA-hfcp-477w-3wjw
Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username
Priority MEDIUM 42
A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite.
TI-2026-01221 CVE-2026-1531 · GHSA-2qxw-7fmx-gqfm
Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
Priority LOW 37
A flaw was found in foreman_kubevirt.
TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
TI-2026-03763 CVE-2026-4324 · GHSA-fwj4-6wgp-mpxm
Rubygem-katello: katello: denial of service and potential information disclosure via sql injection
Priority LOW 24
A flaw was found in the Katello plugin for Red Hat Satellite.