# Theforeman Foreman


- [CVE-2018-14643](https://insights.sbomify.com/CVE-2018-14643/): smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature (critical 9.8)
- [CVE-2026-96659](https://insights.sbomify.com/CVE-2026-96659/): Foreman: excessive permissions for viewer role on preview (critical 9.1)
- [CVE-2023-0118](https://insights.sbomify.com/CVE-2023-0118/): Foreman: arbitrary code execution through templates (critical 9.1)
- [CVE-2026-96658](https://insights.sbomify.com/CVE-2026-96658/): Foreman: foreman: arbitrary code execution via safemode sandbox bypass (high 8.8)
- [CVE-2026-5136](https://insights.sbomify.com/CVE-2026-5136/): Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation (high 8.8)
- [CVE-2021-3590](https://insights.sbomify.com/CVE-2021-3590/): Information disclosure in foreman (high 8.8)
- [CVE-2018-1097](https://insights.sbomify.com/CVE-2018-1097/): Information disclosure in foreman (high 8.8)
- [CVE-2017-7505](https://insights.sbomify.com/CVE-2017-7505/): Missing authorization in foreman (high 8.8)
- [CVE-2016-4475](https://insights.sbomify.com/CVE-2016-4475/): Missing authorization in n/a (high 8.8)
- [CVE-2016-3728](https://insights.sbomify.com/CVE-2016-3728/): Code injection in n/a (high 8.8)
- [CVE-2026-12540](https://insights.sbomify.com/CVE-2026-12540/): Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (high 8.2)
- [CVE-2026-12541](https://insights.sbomify.com/CVE-2026-12541/): Foreman: command injection in foreman-rake database tasks (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/products/theforeman/foreman/