fogproject has 7 CVEs on record between 2025 and 2026. Disclosures have slowed: 2 in the last 90 days after 4 in the 90 before. The busiest recent month was July 2026 with 4. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 4
Worst active — by depth score
CVE-2025-58443Critical· 9.1FOG is a free open-source cloning/imaging/rescue suite/inventory management system66CVE-2026-54554High· 7.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system53CVE-2026-116778High· 8.8FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution48CVE-2026-47688High· 8.2FOG is a free open-source cloning/imaging/rescue suite/inventory management system45CVE-2026-47687High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system40
fogproject vulnerabilities
CVEs affecting fogproject, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-116778High· 8.8FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token …
CVE-2026-54554High· 7.5PoCFOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value…
CVE-2026-47689Medium· 4.6FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates …
CVE-2026-47688High· 8.2FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker v…
CVE-2026-47687High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user i…
CVE-2026-47685High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied val…
CVE-2025-58443Critical· 9.1PoCFOG is a free open-source cloning/imaging/rescue suite/inventory management system
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where…