Red Hat Security AdvisoryRHSA-2026:74503
Satellite 6.19.5 Async Update
Released 2026-10-01 · Red Hat rating Critical · View on Red Hat →
Fixes 31 records
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00608 · Published 2026-07-27 · Partial fix · 8.5.12 CWE-200
Priority HIGH 77
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00575 · Published 2026-07-08 · Partial fix · 5.1.8, 4.3.9 +1 CWE-1284
Priority HIGH 77
sqlparse is a non-validating SQL parser module for Python.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00332 · Published 2026-08-17 · Partial fix · 0.6.0 CWE-1333
Priority HIGH 72
sqlparse is a non-validating SQL parser module for Python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00337 · Published 2026-08-17 · Partial fix · 0.6.0 CWE-1333
Priority HIGH 70
dynaconf is a configuration management tool for Python.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00548 · Published 2026-03-20 · Partial fix · 3.2.13 CWE-1336
Priority MEDIUM 64
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00316 · Published 2026-08-25 · Partial fix · 3.1.59 CWE-73
Priority MEDIUM 46
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00419 · Published 2026-09-09 · Partial fix · 3.1.60 CWE-94
Priority MEDIUM 43
sqlparse is a non-validating SQL parser module for Python.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00263 · Published 2026-08-17 · Partial fix · 0.6.0 CWE-400
Priority MEDIUM 43
A flaw was found in rubygem-foreman_remote_execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01585 · Published 2026-10-01 · Partial fix · 13.2.8-2.el8sat, 13.2.8-2.el9sat +3 CWE-78
Priority MEDIUM 41
A flaw was found in Foreman.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00724 · Published 2026-10-01 · Fixed in 1.5.0-2.el8sat, 1.5.0-2.el9sat +11 CWE-94
Priority MEDIUM 40
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-770
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-06-02 · Partial fix · 1.25.11, 1.26.4 CWE-407
Priority MEDIUM 40
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-400
Priority MEDIUM 40
A flaw was found in Foreman.
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.01236 · Published 2026-10-01 · Partial fix · 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +3 CWE-78
Priority MEDIUM 40
A flaw was found in Foreman.
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.01236 · Published 2026-10-01 · Partial fix · 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +3 CWE-78
Priority LOW 39
A flaw was found in Foreman.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.00347 · Published 2026-10-01 · Fixed in 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +13 CWE-267
Priority LOW 39
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0038 · Published 2026-09-02 · Partial fix · 2.4.6, 3.1.7 +1 CWE-436
Priority LOW 39
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00398 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-436
Priority LOW 39
A flaw was found in Foreman.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00384 · Published 2026-10-01 · Partial fix · 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +3 CWE-306
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00239 · Published 2026-09-02 · Partial fix · 2.4.6, 3.1.7 +1 CWE-116
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-20
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-174
Priority LOW 35
A flaw was found in Foreman.
CVSS 3.1HIGH 7.7· Local · High privileges · User interaction · EPSS 0.00225 · Published 2026-10-01 · Partial fix · 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +3 CWE-502
Priority LOW 35
A flaw was found in Foreman.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00563 · Published 2026-10-01 · Partial fix · 3.12.0.23-1.el8sat, 3.12.0.23-1.el9sat +3 CWE-78
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-08-11 · Partial fix · 3.3.12, 5.1.11 CWE-190
Priority LOW 32
A flaw was found in rubygem-hammer_cli.
CVSS 3.1MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00523 · Published 2026-10-01 · Partial fix · 3.12.0-2.el8sat, 3.12.0-2.el9sat +3 CWE-78
Priority LOW 29
A flaw was found in rubygem-katello.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0029 · Published 2026-10-01 · Partial fix · 4.14.0.23-1.el8sat, 4.14.0.23-1.el9sat +3 CWE-89
Priority LOW 27
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0055 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-407
Priority LOW 27
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0031 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-79
Priority LOW 20
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00381 · Published 2026-08-26 · Partial fix · 4.14.0.23-1.el8sat, 4.14.0.23-1.el9sat +3 CWE-639
Priority LOW 20
A flaw was found in rubygem-katello.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00324 · Published 2026-10-01 · Partial fix · 4.14.0.23-1.el8sat, 4.14.0.23-1.el9sat +3 CWE-203
THREATIST.IORead the docs