fogproject vulnerabilities
CVEs whose affected-version data names the fogproject package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-116778High· 8.8FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token …
CVE-2026-54554High· 7.5PoCFOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value…
CVE-2026-47689Medium· 4.6FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates …
CVE-2026-47688High· 8.2FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker v…
CVE-2026-47687High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user i…
CVE-2026-47685High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied val…
CVE-2025-58443Critical· 9.1PoCFOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where…