Full takeover of Oracle Enterprise Command Center Framework V16 (a component of Oracle E-Business Suite) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, and the vector's adjacent attack surface (AV:A) plus low complexity make it trivial to exploit once network adjacency is achieved. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Full compromise of Oracle Coherence (Core component) is possible for an unauthenticated attacker who can reach the cluster's physical communication segment, per Oracle's July 2026 Critical Patch Update. Affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be taken over completely, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:A). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with no privileges or user interaction required.
Full takeover of Oracle Coherence (Core component) is possible by an unauthenticated attacker positioned on the same physical communication segment as the server, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 with high impact to confidentiality, integrity and availability, and affects Fusion Middleware deployments running Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi-keyex authentication path fails to confirm that the authenticated Kerberos principal is actually authorized for the local user account being requested. An already-authenticated client holding any valid Kerberos principal in the realm can therefore log in as an arbitrary user, including potentially privileged accounts, on Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS of 8.8 reflects a straightforward, low-complexity abuse once a valid Kerberos credential is held.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Arbitrary code execution within the sandbox in Google Chrome prior to 150.0.7871.182 via a type confusion flaw in the WebAudio API. A remote attacker can craft an HTML page that, when opened by a victim, triggers memory corruption leading to code execution in the renderer process. No public exploit or active exploitation has been identified, and EPSS indicates a low exploitation probability despite a high CVSS score.
Arbitrary code execution inside the renderer sandbox in Google Chrome before version 150.0.7871.182 due to an input validation flaw in the WebAudio implementation when handling a crafted HTML page. An attacker can execute arbitrary code within the sandbox by luring a user to a malicious site. No active exploitation reported; a vendor patch is available.
Stack buffer overflow in V8, Chrome's JavaScript engine, enables remote code execution confined to the renderer sandbox when a victim visits a specially crafted HTML page. Affects all Google Chrome releases prior to 150.0.7871.182 on all desktop platforms. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 150.0.7871.182 is available and should be applied immediately given the broad attack surface.
Use-after-free in the Google Chrome UI component (fixed in 150.0.7871.182) allows a remote attacker to induce heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to arbitrary code execution in the renderer. Rated High by Chromium and CVSS 8.8; no public exploit identified at time of analysis, though the vendor patch is available. Exploitation is gated on user interaction, reducing drive-by risk relative to zero-click browser bugs.
Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).
Privilege escalation in Mozilla Firefox's DOM Navigation component allows remote attackers to elevate privileges, and given the CVSS network vector (AV:N/PR:N/UI:N) an attacker could compromise confidentiality, integrity, and availability without authentication or user interaction. The flaw affects Firefox before version 153 and Firefox ESR before 140.13, and was fixed by Mozilla in those releases. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows attackers to escape or elevate beyond the sandboxed content process, gaining higher browser privileges on affected versions prior to Firefox 153. The flaw is a CWE-269 improper privilege management issue reported by Mozilla and patched in Firefox 153 (advisory MFSA2026-68). No public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no observed exploitation activity at time of analysis despite the high CVSS 9.8 rating.
Privilege escalation in Mozilla Firefox's DOM Navigation component (fixed in Firefox 153) allows an attacker to improperly gain elevated privileges within the browser, per Mozilla advisory MFSA2026-68. The flaw carries a CVSS 9.8 rating claiming full confidentiality, integrity, and availability impact with no privileges or user interaction, though this is atypical for a browser DOM bug. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Privilege escalation in Mozilla Firefox's DOM: Workers component lets remote attackers gain elevated privileges within the browser through web-facing content, potentially enabling sandbox/privilege boundary compromise. The flaw was resolved in Firefox 153 and is described in Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no evidence of active or imminent widespread exploitation.
Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.
Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploading a sub-1KB crafted GGUF file whose attacker-controlled string lengths, tensor dimension counts, and metadata array counts are trusted as allocation sizes without bounds checking against the remaining file size. Reachable through the blob upload plus model create/pull API endpoints, the flaw triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass the server's recovery middleware, taking down the whole process rather than a single request. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch is available and VulnCheck has published an advisory.
Uncontrolled native-memory consumption in Netty's SPDY-to-HTTP codec (SpdyHttpDecoder) lets a remote unauthenticated peer exhaust off-heap memory and crash the server. Affected versions are 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final; the decoder allocates a pooled ByteBuf for an in-flight SYN_STREAM request but fails to release it when the stream is aborted via RST_STREAM or when content exceeds maxContentLength. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; impact is denial of service only (VC:N/VI:N/VA:H).
Remote denial of service in the Netty networking framework (codec-haproxy module) versions 4.1.0.Final through 4.1.135 and 4.2.0.Final through 4.2.15.Final lets unauthenticated attackers exhaust JVM direct memory. The HAProxyMessageDecoder mis-parses a PROXY protocol v2 header whose version byte is 0xFF, sign-extending it to -1, which collides with the decoder's 'need more data' sentinel, so ByteToMessageDecoder accumulates inbound bytes in an unbounded cumulation buffer until the process runs out of direct memory. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity effect.
Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.
Denial of service in Amazon's smithy-rs code generation framework allows remote attackers to abort the process via stack exhaustion by sending a small request containing deeply nested data that matches a recursive model shape. The flaw affects generated deserializers for JSON, CBOR, and XML across the AWS SDK for Rust and any custom clients or servers built with smithy-rs codegen; because deserialization runs before business logic, a compact malicious payload can crash the target. This carries a CVSS 4.0 base score of 8.7 (availability-only impact), and no public exploit was identified at time of analysis.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Unauthenticated information disclosure in Feedbin (self-hosted RSS reader, commit 739884a) lets remote attackers read any user's private article content via GET /api/v2/entries/:id/text, which explicitly skipped the authorization filter. Because entry IDs are sequential integers, an attacker can enumerate and harvest plain-text bodies of private newsletters, page-saves, and articles from every user's private subscriptions across the instance. No public exploit identified at time of analysis, though a technical write-up describing the flaw exists; the CVSS 4.0 base score is 8.7 (High) driven purely by confidentiality impact.
Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrative user break out of intended directory boundaries to read arbitrary files, write files to arbitrary locations, and probe for file existence on the underlying server. Rated CVSS 8.7 with a scope change (S:C), the flaw converts application-level admin privileges into host filesystem read/write, but exploitation requires high privileges (PR:H) and there is no public exploit identified at time of analysis. Affected organizations are those self-hosting the on-premises Storage Zones Controller component that fronts ShareFile storage zones.
SQL injection in DHIS2 SQL View data endpoints lets an authenticated user with SQL View execution access supply crafted filter values that are interpolated directly into the generated SQL, allowing them to read data outside the intended SQL View result set. It affects release lines 2.37, 2.38 and 2.39 prior to the 2026-06-09 End-of-Support security updates and carries a vendor CVSS 4.0 score of 8.7 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix reworks filter handling to use parameterized placeholders instead of string interpolation.
Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Objects component) allows a low-privileged, network-based attacker to gain unauthorized read and write access to critical data after tricking a legitimate user into interacting with malicious content. The scope-changing nature (S:C) combined with the Authentication Bypass tag and required user interaction is consistent with a stored cross-site scripting or session-riding style flaw whose impact spills over into additional PeopleSoft products. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated attacker to read, create, delete, or modify all data accessible to the Cash Management component over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond Cash Management itself. No public exploit identified at time of analysis; the CVSS 3.1 base score is 8.7 driven by high confidentiality and integrity impact, though the vector rates exploitation as difficult (AC:H).
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) allows a low-privileged attacker on the same physical communication segment to read and modify all Coherence-accessible data, with a scope change that can significantly impact other products on the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, carrying a CVSS 3.1 base score of 8.7 (High) with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; the flaw is tagged as an authentication bypass and is fixed in the Oracle July 2026 Critical Patch Update.
Stored cross-site scripting in FOG Project's inventory reporting pipeline allows an unauthenticated network attacker to inject persistent JavaScript into the admin interface by submitting a crafted `sysproduct` field to the client-facing `/service/inventory.php` endpoint using any known registered host MAC address. The payload is persisted to the database and executes in an administrator's browser when they open Reports > Inventory, enabling session hijacking, credential theft, or admin-level actions including host manipulation and imaging pipeline control. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 12th percentile), but the stored nature of the payload and its execution in a privileged admin context make this a meaningful risk for any internet-exposed or internally accessible FOG deployment.
Stored XSS in FOG Project's unauthenticated inventory endpoint allows network-accessible attackers to inject persistent malicious scripts that execute in any administrator's browser session. Affecting fogproject versions prior to 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta), the flaw chains an unsanitized write path at /service/inventory.php with unencoded HTML rendering on the Host Management Inventory page, producing a scope-changing XSS condition with high confidentiality and integrity impact on the admin session. No public exploit has been identified at time of analysis, but the unauthenticated write vector combined with high-privilege execution context makes this a high-priority patch despite a low EPSS score of 0.20%.