TH
Vendor
Theforeman
107
CVEs
0
On KEV
7
New 30D
Products
FO9.8
Foreman
Theforeman
86 CVEs0 on KEV7 new
KA9.8
Katello
Theforeman
10 CVEs0 on KEV0 new
FA8.0
Foreman Ansible
Theforeman
2 CVEs0 on KEV0 new
HC8.1
Hammer Cli
Theforeman
2 CVEs0 on KEV0 new
FA6.3
Foreman Azurerm
Theforeman
1 CVEs0 on KEV0 new
FO6.5
Foreman-tasks
Theforeman
1 CVEs0 on KEV0 new
FO7.8
Foremanfogproxmox
Theforeman
1 CVEs0 on KEV0 new
KA–
Kafo
Theforeman
1 CVEs0 on KEV0 new
OP6.1
Openscap
Theforeman
1 CVEs0 on KEV0 new
SP7.1
Smart Proxy Salt
Theforeman
1 CVEs0 on KEV0 new
SP6.1
Smart Proxy Shell Hooks
Theforeman
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-12542 | FO Foreman Theforeman | 7.8 | Oct 1 | Foreman: command injection in foreman-tail |
| CVE-2026-96658 | FO Foreman Theforeman | 8.8 | Oct 1 | Foreman: foreman: arbitrary code execution via safemode sandbox bypass |
| CVE-2026-96659 | FO Foreman Theforeman | 9.1 | Oct 1 | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-12544 | FO Foreman Theforeman | 7.7 | Oct 1 | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-12541 | FO Foreman Theforeman | 8.2 | Oct 1 | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12540 | FO Foreman Theforeman | 8.2 | Oct 1 | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter |
| CVE-2026-12423 | FO Foreman Theforeman | 7.5 | Oct 1 | Foreman: unauthenticated information disclosure via provisioning token validation flaw |
| CVE-2026-81658 | FO Foreman Theforeman | 6.5 | Aug 27 | Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup |
| CVE-2026-5138 | FO Foreman Theforeman | 4.3 | Jul 1 | Foreman: foreman: information disclosure via improper validation of nested request parameters |
| CVE-2026-5135 | FO Foreman Theforeman | 6.5 | Jul 1 | Foreman: foreman: unauthorized modification of host configurations via broken access control |
| CVE-2026-5142 | FO Foreman Theforeman | 6.5 | Jul 1 | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass |
| CVE-2026-5136 | FO Foreman Theforeman | 8.8 | Jul 1 | Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation |
| CVE-2026-13316 | FO Foreman Theforeman | 4.4 | Jun 30 | Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config |
| CVE-2026-9073 | FO Foreman Theforeman | 6.2 | Jun 23 | Foreman-mcp-server: mcp server: insecure sensitive http header sanitization |
| CVE-2026-12112 | FO Foreman Theforeman | 7.8 | Jun 23 | Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse |
| CVE-2026-1961 | FO Foreman Theforeman | 8.8 | Mar 26 | Forman: foreman: remote code execution via command injection in websocket proxy |
| CVE-2025-9572 | FO Foreman Theforeman | 6.5 | Feb 27 | Foreman: satellite: graphql api permission bypass leads to information disclosure |
| CVE-2024-7700 | FO Foreman Theforeman | 6.5 | Aug 12 | A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page |
| CVE-2023-4886 | FO Foreman Theforeman | 4.4 | Oct 3 | A sensitive information exposure vulnerability was found in foreman |
| CVE-2022-3874 | FO Foreman Theforeman | 9.1 | Sep 22 | A command injection flaw was found in foreman |
| CVE-2023-0462 | FO Foreman Theforeman | 9.1 | Sep 20 | An arbitrary code execution flaw was found in Foreman |
| CVE-2023-0118 | FO Foreman Theforeman | 9.1 | Sep 20 | An arbitrary code execution flaw was found in Foreman |
| CVE-2021-20260 | FO Foreman Theforeman | 7.8 | Aug 26 | A flaw was found in the Foreman project |
| CVE-2021-3590 | FO Foreman Theforeman | 8.8 | Aug 22 | A flaw was found in Foreman project |
| CVE-2020-10710 | FO Foreman Theforeman | 4.4 | Aug 16 | A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer |
| CVE-2021-3456 | SP Smart Proxy Salt Theforeman | 7.1 | Mar 30 | An improper authorization handling flaw was found in Foreman |
| CVE-2021-20290 | OP Openscap Theforeman | 6.1 | Mar 25 | An improper authorization handling flaw was found in Foreman |
| CVE-2021-3589 | FA Foreman Ansible Theforeman | 8.0 | Mar 23 | An authorization flaw was found in Foreman Ansible |
| CVE-2021-3584 | FO Foreman Theforeman | 7.2 | Dec 23 | A server side remote code execution vulnerability was found in Foreman project |
| CVE-2021-20259 | FO Foremanfogproxmox Theforeman | 7.8 | Jun 7 | A flaw was found in the Foreman project |
| CVE-2021-3469 | FO Foreman Theforeman | 5.4 | Jun 3 | Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw |
| CVE-2020-10716 | FA Foreman Ansible Theforeman | 6.5 | May 27 | A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view |
| CVE-2021-3457 | SP Smart Proxy Shell Hooks Theforeman | 6.1 | May 12 | An improper authorization handling flaw was found in Foreman |
| CVE-2021-3494 | FO Foreman Theforeman | 5.9 | Apr 26 | A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack |
| CVE-2021-3413 | FA Foreman Azurerm Theforeman | 6.3 | Apr 8 | A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0 |
| CVE-2014-0241 | HC Hammer Cli Theforeman | 5.5 | Dec 13 | rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable |
| CVE-2014-0091 | FO Foreman Theforeman | 5.3 | Dec 11 | Foreman has improper input validation which could lead to partial Denial of Service |
| CVE-2013-4120 | KA Katello Theforeman | 7.5 | Dec 10 | Katello has a Denial of Service vulnerability in API OAuth authentication |
| CVE-2013-0283 | KA Katello Theforeman | 5.4 | Dec 5 | Katello: Username in Notification page has cross site scripting |
| CVE-2013-2101 | KA Katello Theforeman | 5.4 | Dec 3 | Katello has multiple XSS issues in various entities |
| CVE-2019-14825 | KA Katello Theforeman | 2.7 | Nov 25 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9 |
| CVE-2014-8183 | FO Foreman Theforeman | 7.4 | Aug 1 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources |
| CVE-2019-10198 | FO Foreman-tasks Theforeman | 6.5 | Jul 31 | An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7 |
| CVE-2019-3893 | FO Foreman Theforeman | 4.9 | Apr 9 | In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the… |
| CVE-2018-16887 | KA Katello Theforeman | 5.4 | Jan 13 | A cross-site scripting (XSS) flaw was found in the katello component of Satellite |
| CVE-2018-14623 | KA Katello Theforeman | 4.3 | Dec 14 | A SQL injection flaw was found in katello's errata-related API |
| CVE-2018-16861 | FO Foreman Theforeman | 4.8 | Dec 7 | A cross-site scripting (XSS) flaw was found in the foreman component of satellite |
| CVE-2018-14664 | FO Foreman Theforeman | 5.4 | Oct 12 | A flaw was found in foreman from versions 1.18 |
| CVE-2018-14643 | FO Foreman Theforeman | 9.8 | Sep 21 | An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman |
| CVE-2016-7078 | FO Foreman Theforeman | 4.3 | Sep 10 | foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature |
| CVE-2016-7077 | FO Foreman Theforeman | 4.3 | Sep 10 | foreman before 1.14.0 is vulnerable to an information leak |
| CVE-2017-2662 | KA Katello Theforeman | 4.3 | Aug 22 | A flaw was found in Foreman's katello plugin version 3.4.5 |
| CVE-2016-8639 | FO Foreman Theforeman | 5.4 | Aug 1 | It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name |
| CVE-2016-8634 | FO Foreman Theforeman | 5.4 | Aug 1 | A vulnerability was found in foreman 1.14.0 |
| CVE-2016-8613 | FO Foreman Theforeman | 6.1 | Jul 31 | A flaw was found in foreman 1.5.1 |
| CVE-2016-9595 | KA Katello Theforeman | 5.5 | Jul 27 | A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files |
| CVE-2017-7535 | FO Foreman Theforeman | 6.1 | Jul 26 | foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts |
| CVE-2017-2672 | FO Foreman Theforeman | 8.8 | Jun 21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images |
| CVE-2016-9593 | FO Foreman Theforeman | 8.8 | Apr 16 | foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging |
| CVE-2018-1096 | FO Foreman Theforeman | 6.5 | Apr 5 | An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1 |