CVE Tools
Track your stack

Satellite

242 CVEs tracked. 5 of them are in CISA KEV.

This hub aggregates every CVE we track for Satellite, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Satellite CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Satellite CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-032
2026-040
2026-054
2026-063
2026-074
2026-081
2026-090
2026-107
2026-110

Severity

How the 242 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2812%
  • High6627%
  • Medium11949%
  • Low2912%

Latest CVEs

The 15 most recently published vulnerabilities affecting Satellite.

  1. CVE-2026-12542Foreman: command injection in foreman-tail5.3
  2. CVE-2026-96659Foreman: excessive permissions for viewer role on preview9.1
  3. CVE-2026-96658Foreman: foreman: arbitrary code execution via safemode sandbox bypass8.8
  4. CVE-2026-12544Foreman: ssti and insecure deserialization in foreman-rake configuration7.7
  5. CVE-2026-12541Foreman: command injection in foreman-rake database tasks8.2
  6. CVE-2026-12540Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter8.2
  7. CVE-2026-12423Foreman: unauthenticated information disclosure via provisioning token validation flaw7.5
  8. CVE-2026-81658Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup6.5
  9. CVE-2026-5138Foreman: foreman: information disclosure via improper validation of nested request parameters4.3
  10. CVE-2026-5135Foreman: foreman: unauthorized modification of host configurations via broken access control6.5
  11. CVE-2026-5142Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass6.5
  12. CVE-2026-5136Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation8.8
  13. CVE-2026-13316Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config4.4
  14. CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitization6.2
  15. CVE-2026-12112Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse7.8

Product grouping is registry-driven, with AI assist and human review. How it works