Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how theforeman compares to other vendors in security performance

View Risk Score →

foremanForeman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

Risk 26
Severity
4.4
First published (updated )
CVE-2026-13316

Foreman Foreman MCP ServerForeman-mcp-server: mcp server: active session hijacking via insecure session state reuse

Risk 69
Severity
7.8
First published (updated )
CVE-2026-12112

Foreman foreman-mcp-serverForeman-mcp-server: mcp server: insecure sensitive http header sanitization

Risk 26
Severity
6.2
EPSS
0.15%
First published (updated )
CVE-2026-9073

theforeman foremanForeman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Risk 40
Severity
6.5
First published (updated )
CVE-2026-5142

redhat SatelliteForeman: foreman: information disclosure via improper validation of nested request parameters

Risk 24
Severity
4.3
First published (updated )
CVE-2026-5138
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

redhat SatelliteForeman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

Risk 84
Severity
8.8
First published (updated )
CVE-2026-5136

redhat SatelliteForeman: foreman: unauthorized modification of host configurations via broken access control

Risk 40
Severity
6.5
First published (updated )
CVE-2026-5135

redhat SatelliteForeman: satellite: graphql api permission bypass leads to information disclosure

Risk 38
Severity
6.5
First published (updated )
CVE-2025-9572

theforeman foremanForeman: command injection in "host init config" template via "install packages" field on foreman

Risk 44
Severity
6.5
EPSS
0.04%
First published (updated )
CVE-2024-7700

redhat/foremanForeman: world readable file containing secrets

Risk 60
Severity
6.7
First published (updated )
CVE-2023-4886
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

redhat/foremanArbitrary code execution through yaml global parameters

Risk 72
Severity
9.1
First published (updated )
CVE-2023-0462

redhat SatelliteForeman: arbitrary code execution through templates

Risk 72
Severity
9.1
First published (updated )
CVE-2023-0118

rubygems/foremanOs command injection via ct_command and fcct_command

Risk 74
Severity
9.1
First published (updated )
CVE-2022-3874

theforeman Foreman AnsibleAn authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissio…

Risk 67
Severity
8
First published (updated )
CVE-2021-3589

theforeman foremanInfoleak

Risk 81
Severity
8.8
First published (updated )
CVE-2021-3590
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

theforeman foremanOS Command Injection, Command Injection

Risk 78
Severity
9
First published (updated )
CVE-2021-3584

redhat/foremanThe realm_freeipa module of Foreman smart proxy suffers from a flaw that can be exploited as a man-i…

Risk 35
Severity
5.9
First published (updated )
CVE-2021-3494

redhat/foremanForeman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling fla…

Risk 35
Severity
5.4
First published (updated )
CVE-2021-3469

theforeman Smart Proxy Salt ForemanOn Foreman, Salt plugin for smart-proxy introduce a flaw which allows any client to perform actions …

Risk 54
Severity
7.1
First published (updated )
CVE-2021-3456

redhat/smart_proxy_shellhooksOn Foreman, Shellhooks plugin for smart-proxy introduce a flaw which allows any client to perform ac…

Risk 43
Severity
6.1
First published (updated )
CVE-2021-3457
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

redhat/smart_proxy_openscapAn improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-prox…

Risk 43
Severity
6.1
First published (updated )
CVE-2021-20290

theforeman foremanInfoleak

Risk 71
Severity
7.8
First published (updated )
CVE-2021-20260

redhat/foreman_fog_proxmoxInfoleak

Risk 71
Severity
7.8
First published (updated )
CVE-2021-20259

redhat/tfm-rubygem-foreman_azure_rmInfoleak

Risk 46
Severity
6.5
First published (updated )
CVE-2021-3413

redhat/tfm-rubygem-foreman_ansibleThe "User input" entry from Job Invocation may contain plaintext password or other sensitive data. A…

Risk 38
Severity
6.5
First published (updated )
CVE-2020-10716
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

redhat/foreman-installerA flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellit…

Risk 27
Severity
4.4
First published (updated )
CVE-2020-10710

theforeman Hammer CLIrubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

Risk 32
Severity
5.5
First published (updated )
CVE-2014-0241

debianInput Validation

Risk 27
Severity
5.3
First published (updated )
CVE-2014-0091

theforeman katelloKatello has a Denial of Service vulnerability in API OAuth authentication

Risk 43
Severity
7.5
First published (updated )
CVE-2013-4120

theforeman katelloXSS

Risk 34
Severity
5.4
First published (updated )
CVE-2013-0283
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203