CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778

The FOG cloning and imaging suite is vulnerable to root command execution in versions prior to 1.5.10.2253 and 1.6.0-RC-1 . An authenticated API-enabled user (uType=1) with both a personal and a global FOG API token can exploit a missing authorization check on the PUT /fog/storagenode/{id}/edit e...

EUVD-2026-112150

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

PT-2026-128264

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778: Improper Neutralization of Special Elements used in an OS Command

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

FOG Project FOG command injection vulnerability

Versions prior to FOG 1.5.10.2253 and versions prior to 1.6.0-RC-1 contain a security vulnerability. This vulnerability stems from API validation of credentials without enforcing administrator roles. Low-privilege authenticated users with API access can modify the user, pass, and ftppath fields o...

EUVD-2025-25389

Malicious code in bioql PyPI...

CVE-2025-8610

AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability. The specific fla...

CVE-2025-8610 AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability

AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability. The specific fla...

CVE-2025-8610

CVE-2025-8610 concerns AOMEI Cyber Backup. The flaw is a missing authentication in the StorageNode service (listening on TCP 9075 by default) that allows remote code execution in the SYSTEM context. This is a network-accessible vulnerability with high impact (confidentiality, integrity, and avail...

CVE-2025-8610: Missing Authentication for Critical Function

AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability. The specific fla...

(0Day) AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StorageNode service, which listens on TCP port 9075 by default. The issue results...