foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

foreman: Safemode Bypass leading to RCE

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

foreman: Safemode Bypass leading to RCE

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

foreman: Safemode Bypass leading to RCE

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-96658

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-96659

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-96658 Foreman: safemode bypass leading to rce

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-96658 Foreman: safemode bypass leading to rce

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

EUVD-2026-90921

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-96658

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) . The vulnerability resides in the templating engine 's safemode sandbox , where improper handling of delegated methods enables an attacker to append unauthorized functions to the ...

CVE-2026-96658

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

foreman: Safemode Bypass leading to RCE

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

PT-2026-103944

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Red Hat Satellite affected versions not specified Description An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the...

CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

EUVD-2026-60586

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74905

SiYuan before v3.7.4 contains a full-read SSRF vulnerability in the isPrivateIP function (kernel/util/net.go), which powers the SSRFSafeDialer SSRF guard in SafeMode. The function fails to recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed privat...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...