RH
Product
Red Hat Satellite 6.18
On CISA KEVExploited in the wild
38
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 9High 18Medium 10Low 1
Watch
Add Red Hat Satellite 6.18 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42043 | 10.0 | Apr 24 | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 Affected: All versions, or not specified |
| CVE-2026-34444 | 10.0 | Apr 6 | Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr Affected: All versions, or not specified |
| CVE-2026-32871 | 10.0 | Apr 2 | FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability Affected: All versions, or not specified |
| CVE-2026-4800 | 9.8 | Mar 31 | lodash vulnerable to Code Injection via `_.template` imports key names Affected: All versions, or not specified |
| CVE-2026-29063 | 9.8 | Mar 6 | Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable Affected: All versions, or not specified |
| CVE-2025-69872 | 9.8 | Feb 11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default Affected: All versions, or not specified |
| CVE-2026-44990 | 9.3 | Jun 12 | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Affected: All versions, or not specified |
| CVE-2026-25896 | 9.3 | Feb 20 | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names Affected: All versions, or not specified |
| CVE-2026-42044 | 9.1 | Apr 24 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` Affected: All versions, or not specified |
Showing 9