CWE-778

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:00:12.607042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:09:48.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Controller/AppController.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/AppController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\u003c/p\u003e\n\u003cp\u003eHowever, \u003ccode\u003eUser-\u0026gt;setupRedis()\u003c/code\u003e returns false when Redis cannot be reached. The vulnerable \u003ccode\u003e_shouldLog()\u003c/code\u003e logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\n\n\nHowever, User-\u003esetupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T11:24:21.354Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/a39b25d2f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.\u003c/p\u003e"
            }
          ],
          "value": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts."
        }
      ],
      "title": "MISP: Authentication failure logging suppressed during Redis unavailability",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.",
                  "The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.",
                  "The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.",
                  "The commit date (2 Sep 2026) is taken at face value from the patch metadata."
                ],
                "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).",
                "draft": false,
                "fixSummary": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.",
                "generatedAt": "2026-09-15T09:34:28.852379Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                "patchSummary": "In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis-\u003eexists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
                    "patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
                    "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                    "subject": "fix: [logging] Log auth failures when the throttle cannot"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
                "subject": "fix: [logging] Log auth failures when the throttle cannot",
                "tagVersionBoundary": {
                  "commits_after_fix": 189,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20172"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-92002",
    "datePublished": "2026-09-15T11:24:21.354Z",
    "dateReserved": "2026-09-15T11:24:19.778Z",
    "dateUpdated": "2026-09-15T12:09:48.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:04:57.329720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:05:17.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Model/AccessLog.php"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/AccessLog.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\u003c/p\u003e\n\u003cp\u003eBecause \u003ccode\u003eCakeErrorController\u003c/code\u003e extends \u003ccode\u003eAppController\u003c/code\u003e, exception rendering runs the application startup path a second time. As a result, \u003ccode\u003e__accessMonitor()\u003c/code\u003e calls \u003ccode\u003eAccessLog::logRequest()\u003c/code\u003e twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\u003c/p\u003e\n\u003cp\u003eThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an \u003ccode\u003eUPDATE\u003c/code\u003e rather than insert an obvious duplicate row.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception.\n\n\nBecause CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log.\n\n\nThe bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T09:26:35.198Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/0dae5c072"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u0026gt;create() call is added before $this-\u0026gt;save() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation."
        }
      ],
      "title": "MISP Access Log Entry Overwritten by Error Controller\u0027s Second beforeFilter Pass",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "MISP requires authentication for the operations that produce access-log entries; PR:L assumes a low-privilege authenticated user can trigger an unhandled exception.",
                  "The affected version range is inferred from the tag_version_boundary (v2.5.46, 190 commits after fix); the exact first-affected and last-affected versions are not stated in the patch metadata.",
                  "The security impact is limited to log-integrity degradation; no direct data exfiltration, privilege escalation, or denial-of-service is evidenced by the patch.",
                  "The double beforeFilter invocation is a CakePHP framework behavior (ExceptionRenderer::_getController calling startupProcess on CakeErrorController) and is not itself a MISP vulnerability, but MISP\u0027s AccessLog model did not guard against it."
                ],
                "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by any authenticated user who can trigger an unhandled exception (e.g., via a malformed request). No attack target manipulation is required (AT:N). Low privileges are sufficient (PR:L) as any authenticated MISP user can cause an error. No user interaction is needed (UI:N). There is no direct confidentiality or availability impact on MISP itself (VC:N, VA:N). The integrity impact is low (VI:L) because the access-log row is overwritten with incorrect metrics rather than deleted, and only requests that trigger exceptions are affected. No secondary impacts are identified (SC:N, SI:N, SA:N). The overall severity is low, reflecting a logging-integrity weakness that degrades audit reliability but does not directly expose data or disrupt service.",
                "draft": false,
                "fixSummary": "The fix introduces a per-instance boolean guard ($deferredWriterRegistered) in the AccessLog model so that logRequest() returns early on the second beforeFilter pass, preventing the error controller from overwriting the original request\u0027s log entry. Additionally, a $this-\u003ecreate() call is added before $this-\u003esave() in saveOnShutdown() to ensure each save issues an INSERT rather than an UPDATE, providing defense-in-depth against accidental row mutation.",
                "generatedAt": "2026-09-15T09:22:08.485154Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 4,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                "patchSummary": "In app/Model/AccessLog.php: (1) Added a private $deferredWriterRegistered property (default false). (2) At the top of logRequest(), added an early-return guard: if $this-\u003edeferredWriterRegistered is true, return true immediately. (3) Set $this-\u003edeferredWriterRegistered = true immediately before register_shutdown_function() so the flag is latched on the first pass. (4) In saveOnShutdown(), added $this-\u003ecreate() before $this-\u003esave() to force a new-row INSERT and prevent the model from issuing an UPDATE against a previously saved id. (5) Added explanatory doc-comments describing the double-beforeFilter mechanism and the ClassRegistry single-instance behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "0dae5c072d86e62140c385cf507135f196415fa6",
                    "patchSha256": "4eeecd38b5b824e3c5c1ae20886e62534ebed473410f59bea7276f83b32d4051",
                    "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                    "subject": "fix: [logging] Stop the error controller overwriting the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/0dae5c072.patch",
                "subject": "fix: [logging] Stop the error controller overwriting the",
                "tagVersionBoundary": {
                  "commits_after_fix": 190,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The access-log mechanism fails to preserve accurate, immutable records of each request. The second beforeFilter pass overwrites the first pass\u0027s data, so the log does not faithfully reflect the actual request\u0027s duration, query count, memory usage, or SQL activity. This constitutes insufficient logging because the security-relevant audit data is corrupted rather than simply missing."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "The genuine request metrics (duration, query count, memory, query log) are replaced by the error controller\u0027s metrics, effectively omitting the security-relevant information that the original request produced. This is a secondary mapping; CWE-778 is the primary weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20138"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-91859",
    "datePublished": "2026-09-15T09:26:35.198Z",
    "dateReserved": "2026-09-15T09:26:32.260Z",
    "dateUpdated": "2026-09-15T13:05:17.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T12:55:46.663079Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:00:29.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CLIShell (app/Console/Command/CLIShell)",
            "SysLogLogableBehavior (app/Plugin/SysLogLogable/Model/Behavior)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Console/Command/CLIShell.php",
            "app/Console/Command/CLIShell/cli_common.php",
            "app/Console/Command/CLIShell/cli_users.php",
            "app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\u003c/p\u003e\n\u003cp\u003eThe shell is designed to run actions as a supplied MISP user ID. However, the legacy \u003ccode\u003eSysLogLogable\u003c/code\u003e behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP\u2019s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.\n\n\nThe shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user.\n\n\n\nVersion affected: \u22642.5.45"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-223",
              "description": "CWE-223 Omission of Security-relevant Information in Log Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:37:54.001Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/d13e5db33"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker."
        }
      ],
      "title": "MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary indicates the fix commit is 183 commits after tag v2.5.46, suggesting the fix landed in a version after 2.5.46; however, no explicit fixed version tag is provided, so the exact boundary is uncertain.",
                  "The affected version range is assumed to be all versions prior to the fix commit; the patch does not specify a minimum affected version.",
                  "CVSS PR:H assumes that CLI shell access is equivalent to site-admin-equivalent access, consistent with the project\u0027s own CLI_usage.md documentation stating that running cake requires reading database.php and that the shell should not be exposed to anyone who must not have site-admin-equivalent access.",
                  "The SI:L rating assumes the audit-log inaccuracy is a secondary integrity impact on the logging subsystem rather than a primary integrity impact on the MISP application data.",
                  "The patch does not include a CVE or GCVE identifier; this analysis is a draft for CNA/GNA review."
                ],
                "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "Attack vector is Local because the CLI shell requires direct access to the MISP host and the ability to run the cake console command. Attack complexity is Low because no race condition or special timing is needed; the identity loss occurs deterministically on the first lazy model load. No attack target is required. Privileges Required is High because running the CLI shell requires reading app/Config/database.php and passing a user ID, which the project documentation equates to site-admin-equivalent access. No user interaction is needed. There is no direct confidentiality, integrity, or availability impact on the MISP application itself. The secondary integrity impact is Low: the audit log data is inaccurate (wrong user attribution, missing CLI marker, missing user-management entries), which degrades forensic and compliance capability but does not corrupt application data. No secondary availability impact.",
                "draft": false,
                "fixSummary": "The fix introduces a process-wide static identity (setShellUser) on SysLogLogableBehavior that is resolved at write time rather than at setup time, so it survives lazy model loads that re-run setup() on the singleton. The behavior appends \u0027via CLI\u0027 to the log description for shell-originated rows, mirroring the request_type = CLI marker in the new audit engine. The CLI shell now publishes the impersonated user through both Configure::write(\u0027CurrentUserId\u0027) and SysLogLogableBehavior::setShellUser() before any write. Explicit extralog calls were added for CLI user edit, disable, and delete operations so the default audit engine records them the same way the web path does. Background jobs that publish no user continue to log as SYSTEM without a CLI marker.",
                "generatedAt": "2026-09-14T12:23:30.990762Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                "patchSummary": "In cli_common.php, __setUserContext() was replaced: instead of iterating loaded models and setting the user on each SysLogLogable behavior instance, it now calls Configure::write(\u0027CurrentUserId\u0027, $user[\u0027id\u0027]) and SysLogLogableBehavior::setShellUser($user). In SysLogLogableBehavior.php, a private static $shellUser property and setShellUser() static method were added; _saveLog() now resolves the actor via shellActor() at write time when CAKEPHP_SHELL is defined, and appends \u0027 via CLI\u0027 to the description. setup() was refactored to use the same shellActor() helper. In cli_users.php, __logUserEdit() was added to write an extralog row for user edits and disables, and __deleteUser() now calls extralog for permanent deletions. A new test file SysLogLogableShellIdentityTest.php (395 lines) covers identity persistence across lazy model attaches, CLI marker presence/absence, SYSTEM fallback, and web-request isolation. CLI_usage.md documents the audit-trail behavior.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "d13e5db33faa8eb27c945d6561badc24f00b2cda",
                    "patchSha256": "8ea0cae590f0d9a3a2fa579b800f69fb5f5f8c9083de74df05945869dd3e91bf",
                    "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                    "subject": "fix: [cli] Attribute interactive CLI shell writes stably and"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/d13e5db33.patch",
                "subject": "fix: [cli] Attribute interactive CLI shell writes stably and",
                "tagVersionBoundary": {
                  "commits_after_fix": 183,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-778",
                    "rationale": "The CLI shell\u0027s audit rows lost the impersonated user identity after the first lazy model load (reset to SYSTEM), and user-management operations (edit, disable, delete) performed via CLI produced no audit row at all in the default engine. Both are failures to record security-relevant events with sufficient detail."
                  },
                  {
                    "cweId": "CWE-223",
                    "rationale": "Audit rows written by the CLI shell carried no marker distinguishing them from web-originated actions. In the default engine the description lacked \u0027via CLI\u0027; in the new engine request_type was not set to CLI. This omission prevents an investigator from determining the true origin of an action."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20197"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90955",
    "datePublished": "2026-09-14T12:37:54.001Z",
    "dateReserved": "2026-09-14T12:37:52.348Z",
    "dateUpdated": "2026-09-14T13:00:29.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82863",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T10:50:32.681291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T10:55:23.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/hulumi/baseline",
          "product": "baseline",
          "vendor": "hulumi",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:34.583Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gfp8-mp24-5vxg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-gfp8-mp24-5vxg"
        },
        {
          "name": "VulnCheck Advisory: @hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-baseline-before-1.3.2-cloudtrail-selector-tampering-detection"
        }
      ],
      "title": "@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82863",
    "datePublished": "2026-08-31T08:46:34.583Z",
    "dateReserved": "2026-08-31T08:37:53.169Z",
    "dateUpdated": "2026-08-31T10:55:23.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76208",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T15:09:35.240836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T15:12:14.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "phpMyFAQ",
          "vendor": "thorsten",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:-:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "pavelkohout396"
        }
      ],
      "datePublic": "2026-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus(\u0027active\u0027) unconditionally, which overwrites the account_status column of a pre-existing local account from \u0027blocked\u0027 to \u0027active\u0027. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:01:55.901Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-8pr3-q3cw-q234)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8pr3-q3cw-q234"
        },
        {
          "name": "VulnCheck Advisory: phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpmyfaq-through-authentication-bypass-via-ldap"
        }
      ],
      "title": "phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76208",
    "datePublished": "2026-08-19T14:01:55.901Z",
    "dateReserved": "2026-08-19T11:34:28.576Z",
    "dateUpdated": "2026-08-19T15:12:14.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:24:17.455538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:35:17.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2022 (CU 26)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.4275.2",
              "status": "affected",
              "version": "16.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2022 (GDR)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.1200.5",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2025 (CU8)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.0.4085.5",
              "status": "affected",
              "version": "17.0.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.0.1135.8",
              "status": "affected",
              "version": "17.0.1050.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "16.0.1200.5",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "17.0.1135.8",
                  "versionStartIncluding": "17.0.1050.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "17.0.4085.5",
                  "versionStartIncluding": "17.0.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "16.0.4275.2",
                  "versionStartIncluding": "16.0.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-08T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778: Insufficient Logging",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T22:50:54.286Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft SQL Server Security Feature Bypass Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66816"
        }
      ],
      "title": "Microsoft SQL Server Security Feature Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-66816",
    "datePublished": "2026-09-08T17:14:27.698Z",
    "dateReserved": "2026-07-27T19:02:26.601Z",
    "dateUpdated": "2026-09-14T22:50:54.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T15:10:06.249329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T15:10:15.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.x.x"
            },
            {
              "status": "affected",
              "version": "9.0.x.x"
            },
            {
              "lessThan": "5.2.4",
              "status": "affected",
              "version": "5.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "vSphere Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.x.x"
            },
            {
              "status": "affected",
              "version": "9.0.x.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ESX",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "ESXi-9.1.0.0-25370933",
              "status": "affected",
              "version": "9.1.x.x",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi-9.0.2.0100-25595025",
              "status": "affected",
              "version": "9.0.x.x",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi80U3j-25429389",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telco Cloud Platform",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "5.1.x"
            },
            {
              "status": "affected",
              "version": "5.0.x"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T04:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "VMware ESX contains an insufficient logging vulnerability.\u0026nbsp;\u003cspan\u003eA malicious administrator could exploit this issue to perform certain operations without them being logged.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware ESX contains an insufficient logging vulnerability.\u00a0A malicious administrator could exploit this issue to perform certain operations without them being logged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-30T12:45:02.292Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ESX insufficient logging vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41709",
    "datePublished": "2026-07-30T12:45:02.292Z",
    "dateReserved": "2026-04-22T06:21:34.490Z",
    "dateUpdated": "2026-07-30T15:10:15.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T14:44:41.820201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T14:45:06.182Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerScale OneFS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "9.5.1.7 or later",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.7.1.14 or later",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.10.1.6 or later",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.13.0.0 or later",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-04T18:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering."
            }
          ],
          "value": "Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778: Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T13:49:36.194Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000461228/dsa-2026-172-security-update-for-dell-powerscale-onefs-insufficient-logging-vulnerability"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2026-32803",
    "datePublished": "2026-05-08T13:49:36.194Z",
    "dateReserved": "2026-03-16T17:04:36.794Z",
    "dateUpdated": "2026-05-08T14:45:06.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T13:16:08.879696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T13:19:58.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/juju/",
          "defaultStatus": "unaffected",
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "3.6.19",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dima Tisnek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Juju from version 3.0.0 through 3.6.18, the authorization of the \"secret-set\" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the \"secret-set\" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-124",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-124: Shared Resource Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T12:47:02.982Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "vdb-entry"
          ],
          "url": "https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unauthorized access to Kubernetes secrets in Juju"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-32693",
    "datePublished": "2026-03-18T12:47:02.982Z",
    "dateReserved": "2026-03-13T12:53:34.544Z",
    "dateUpdated": "2026-03-18T13:19:58.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:18:25.618376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:18:43.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CyberPanel",
          "vendor": "CyberPanel",
          "versions": [
            {
              "lessThan": "2.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 Insufficient Logging",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T19:52:43.151Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-29812",
    "datePublished": "2026-09-13T00:00:00.000Z",
    "dateReserved": "2026-03-04T00:00:00.000Z",
    "dateUpdated": "2026-09-14T18:18:43.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}