FOGProject fogproject vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20247
3. 20251
4. 20268

Newest CVEs

• CVE-2026-116778

  FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

  FOGProject · fogproject

  High8.8
• CVE-2026-54554

  FOG adInfo endpoint is reported to disclose the Active Directory join password

  FOGProject · fogproject

  High7.5
• CVE-2026-47689

  FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab

  FOGProject · fogproject

  Medium4.6
• CVE-2026-47688

  FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

  FOGProject · fogproject

  High8.2
• CVE-2026-47687

  FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

  FOGProject · fogproject

  High7.3
• CVE-2026-47685

  FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

  FOGProject · fogproject

  High7.3
• CVE-2026-33739

  FOG has Stored XSS in Multiple Management Pages

  FOGProject · fogproject

  Medium5.7
• CVE-2026-24138

  FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`

  FOGProject · fogproject

  High7.5
• CVE-2025-58443

  FOG's authentication bypass leads to full SQL DB dump

  FOGProject · fogproject

  Critical9.9
• CVE-2024-42349

  FOG has a Log Information Disclosure

  FOGProject · fogproject

  Medium5.3