These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-54554 debrief based on the supplied source corpus. The CVE record was published on 2026-10-14T18:08:03.179Z and has not been modified since then. The vulnerability affects FOG project deployments using Active Directory integration. Defenders should assess exposure and verify their versions. The issue is fixed in FOG version 1.5.10.1870. The adInfo endpoint discloses the Active Directory join pass [truncated]
The FOG Project is vulnerable to a stored cross-site scripting (XSS) attack. The `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. This allows an unauthenticated attacker who knows any registered host's MAC address to POST malicious inventory values to `/service/inventory.php`, which stores them in the databas [truncated]
CVE-2026-47688 is a high-severity vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. An unauthenticated attacker can exploit this vulnerability via a single HTTP GET request to the public 'client' node endpoint, allowing remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks without requiring login, session, or [truncated]
The FOG Project is vulnerable to a high-severity issue, CVE-2026-47687, which allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. This issue arises from the `selectForm()` helper in `fogpage.class.php` rendering `<option>` labels using raw, unescaped user input. An attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to [truncated]
FOG, a free open-source cloning/imaging/rescue suite/inventory management system, has a vulnerability in versions prior to 1.5.10.1832 and 1.6.0-beta.2313. The unauthenticated inventory service endpoint persists client-supplied values without sanitization. The Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that exe [truncated]
CVE-2026-24138 is an unauthenticated SSRF vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. The vulnerability affects versions 1.5.10.1754 and below, and can be triggered by providing a user-controlled URL parameter in getversion.php. This issue appears to be reachable without an authenticated web session when the request includes newService=1. The vulnerab [truncated]