{"items":[{"id":"CVE-2026-116778","published":"2026-10-28T15:49:59.899Z","updated":"2026-10-28T16:06:35.677Z","title":"FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution","severity":"HIGH","score":8.8,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00467,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54554","published":"2026-10-14T18:08:03.179Z","updated":"2026-10-20T01:47:46.473Z","title":"FOG adInfo endpoint is reported to disclose the Active Directory join password","severity":"HIGH","score":7.5,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00583,"kevAdded":null,"exploit":true},{"id":"CVE-2026-47689","published":"2026-07-21T20:42:19.896Z","updated":"2026-07-22T18:25:04.533Z","title":"FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab","severity":"MEDIUM","score":4.6,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00266,"kevAdded":null,"exploit":false},{"id":"CVE-2026-47688","published":"2026-07-21T20:40:31.480Z","updated":"2026-07-22T13:41:39.164Z","title":"FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules","severity":"HIGH","score":8.2,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00267,"kevAdded":null,"exploit":true},{"id":"CVE-2026-47687","published":"2026-07-21T20:39:01.101Z","updated":"2026-07-22T14:31:39.609Z","title":"FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint","severity":"HIGH","score":7.3,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00406,"kevAdded":null,"exploit":true},{"id":"CVE-2026-47685","published":"2026-07-21T20:37:32.498Z","updated":"2026-07-22T18:25:10.593Z","title":"FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page","severity":"HIGH","score":7.3,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00372,"kevAdded":null,"exploit":false},{"id":"CVE-2026-33739","published":"2026-03-27T19:45:12.642Z","updated":"2026-03-27T20:29:44.713Z","title":"FOG has Stored XSS in Multiple Management Pages","severity":"MEDIUM","score":5.7,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.0019,"kevAdded":null,"exploit":true},{"id":"CVE-2026-24138","published":"2026-01-23T00:19:33.776Z","updated":"2026-01-23T19:56:37.266Z","title":"FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`","severity":"HIGH","score":7.5,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00413,"kevAdded":null,"exploit":true},{"id":"CVE-2025-58443","published":"2025-09-06T20:04:25.442Z","updated":"2025-09-08T14:34:35.606Z","title":"FOG's authentication bypass leads to full SQL DB dump","severity":"CRITICAL","score":9.9,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.21291,"kevAdded":null,"exploit":true},{"id":"CVE-2024-42349","published":"2024-08-02T20:01:29.055Z","updated":"2024-08-05T19:46:15.123Z","title":"FOG has a Log Information Disclosure","severity":"MEDIUM","score":5.3,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00568,"kevAdded":null,"exploit":true},{"id":"CVE-2024-42348","published":"2024-08-02T19:58:12.740Z","updated":"2024-08-05T15:16:30.380Z","title":"FOG leaks sensitive information (AD domain, username and password)","severity":"CRITICAL","score":9.3,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00587,"kevAdded":null,"exploit":true},{"id":"CVE-2024-41954","published":"2024-07-31T19:23:41.492Z","updated":"2024-07-31T20:30:19.312Z","title":"FOG Weak file permissions","severity":"MEDIUM","score":5.3,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00309,"kevAdded":null,"exploit":true},{"id":"CVE-2024-41108","published":"2024-07-31T19:04:59.847Z","updated":"2024-07-31T20:16:30.160Z","title":"FOG Sensitive Information Disclosure","severity":"HIGH","score":7.5,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00552,"kevAdded":null,"exploit":true},{"id":"CVE-2024-40645","published":"2024-07-31T18:57:50.347Z","updated":"2024-07-31T20:13:14.492Z","title":"FOG Authenticated File Upload RCE","severity":"HIGH","score":8.8,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00964,"kevAdded":null,"exploit":true},{"id":"CVE-2024-39916","published":"2024-07-12T15:00:10.035Z","updated":"2024-08-02T04:33:11.556Z","title":"NFS server misconfiguration allows file access outside the exported directory","severity":"MEDIUM","score":6.4,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2024-39914","published":"2024-07-12T14:46:44.696Z","updated":"2024-08-02T04:33:11.177Z","title":"FOG has a command injection in /fog/management/export.php?filename=","severity":"CRITICAL","score":9.8,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.23237,"kevAdded":null,"exploit":true},{"id":"CVE-2023-46237","published":"2023-10-31T14:59:37.088Z","updated":"2024-09-05T17:39:26.525Z","title":"FOG path traversal via unauthenticated endpoint","severity":"MEDIUM","score":5.8,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00576,"kevAdded":null,"exploit":false},{"id":"CVE-2023-46236","published":"2023-10-31T14:32:32.703Z","updated":"2024-09-05T17:46:22.358Z","title":"FOG SSRF via unauthenticated endpoint(s)","severity":"HIGH","score":8.6,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.0056,"kevAdded":null,"exploit":false},{"id":"CVE-2023-46235","published":"2023-10-31T14:25:12.617Z","updated":"2024-09-05T17:47:51.243Z","title":"FOG stored XSS on log screen via unsanitized request logging","severity":"MEDIUM","score":5.4,"vendor":"FOGProject","product":"fogproject","kev":false,"epss":0.00361,"kevAdded":null,"exploit":false}]}