CVE-2026-24138

HighCVSS 7.5/10Last modified Oct 6, 2026

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-241396.5MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization b CVE-2026-24149.8Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.CVE-2026-241405.3MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in CVE-2026-241417.8NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe dese CVE-2026-241429.8NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulner CVE-2026-241467.5NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a serv CVE-2026-241474.8NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading CVE-2026-241489.4NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initia CVE-2026-241497.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code inje CVE-2026-24155.9Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templat CVE-2026-241507.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciou CVE-2026-241517.8NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously cra