Monthly
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the risk is real for security teams relying on this package as a primary CloudTrail integrity control.
LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.
Let me produce the JSON. Key details: MISP ≤2.5.45, Redis-based throttling of auth-failure logs; when Redis unavailable, _shouldLog() returned false, silencing logging. CWE-778 insufficient logging. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N — 5.1. Hmm, PR:L, UI:P. That's odd but okay. Impact: integrity of log data (VI:L). Actually the impact is loss of audit logs — integrity of the log record. Patch available: commit a39b25d2f. Reported by CIRCL. No KEV, no POC (POC status unknown — no POC data provided). Say "no public exploit identified at time of analysis". Prevalence: MISP is a widely used threat-intelligence sharing platform — medium to high. I'd say medium (common in SOC/CTI environments, not everywhere). Actually MISP is widely deployed among CERTs, SOCs, threat intel teams. I'd say "medium". assessed CVSS 3.1 vector: The flaw requires Redis to be unavailable (a precondition) and an attacker to attempt failed authentications (PR:L? actually auth failure attempts imply unauthenticated attackers trying). Hmm. The result is log suppression. AV:N, AC:H? The condition is a Redis outage — that's a configuration/environment condition. Let's think: CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N? Hmm. The logging suppression is a loss of accountability — impact on integrity of the log. But does it require the attacker to do anything? The vulnerability triggers whenever Redis is down and failed auth attempts occur. Attackers don't need privileges. However the 4.0 vector says PR:L — probably because the actor is "authenticated" in the sense that... hmm, actually the CNA scored PR:L. I need to produce my own independent vector. I'd argue: AV:N (attackers attempt auth remotely), AC:H (requires Redis unavailable — an environmental precondition, not attacker-controlled), PR:N (failed authentication attempts are unauthenticated by definition), UI:N, S:U, C:N, I:L (log integrity/audit trail), A:N. Hmm but should I use PR:L to align with the
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
CyberPanel versions before 2.4.4 fail to record audit log entries when authenticated panel users interact with the child domains management interface, allowing configuration manipulation to proceed without any forensic trail. The upstream fix commit also reveals a companion access-control defect: a missing return path in the ACL ownership check (checkOwnership() in acl.py) and an ORM filter regression in fetchChildDomainsMain that broadened the child domain result set beyond intended alias-excluded entries. Together, these gaps allow an authenticated low-privilege user to alter domain list state silently, undermining post-incident accountability. No public exploit has been identified at time of analysis.
Insufficient audit logging in Microsoft SQL Server 2022 and 2025 allows a low-privileged authenticated attacker to bypass a security control over the network, resulting in high-confidentiality data access without a corresponding audit trail. Affected versions span both the GDR and Cumulative Update branches of SQL Server 2022 (pre-16.0.4275.2 / pre-16.0.1200.5) and SQL Server 2025 (pre-17.0.4085.5 / pre-17.0.1135.8). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the risk is real for security teams relying on this package as a primary CloudTrail integrity control.
LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.
Let me produce the JSON. Key details: MISP ≤2.5.45, Redis-based throttling of auth-failure logs; when Redis unavailable, _shouldLog() returned false, silencing logging. CWE-778 insufficient logging. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N — 5.1. Hmm, PR:L, UI:P. That's odd but okay. Impact: integrity of log data (VI:L). Actually the impact is loss of audit logs — integrity of the log record. Patch available: commit a39b25d2f. Reported by CIRCL. No KEV, no POC (POC status unknown — no POC data provided). Say "no public exploit identified at time of analysis". Prevalence: MISP is a widely used threat-intelligence sharing platform — medium to high. I'd say medium (common in SOC/CTI environments, not everywhere). Actually MISP is widely deployed among CERTs, SOCs, threat intel teams. I'd say "medium". assessed CVSS 3.1 vector: The flaw requires Redis to be unavailable (a precondition) and an attacker to attempt failed authentications (PR:L? actually auth failure attempts imply unauthenticated attackers trying). Hmm. The result is log suppression. AV:N, AC:H? The condition is a Redis outage — that's a configuration/environment condition. Let's think: CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N? Hmm. The logging suppression is a loss of accountability — impact on integrity of the log. But does it require the attacker to do anything? The vulnerability triggers whenever Redis is down and failed auth attempts occur. Attackers don't need privileges. However the 4.0 vector says PR:L — probably because the actor is "authenticated" in the sense that... hmm, actually the CNA scored PR:L. I need to produce my own independent vector. I'd argue: AV:N (attackers attempt auth remotely), AC:H (requires Redis unavailable — an environmental precondition, not attacker-controlled), PR:N (failed authentication attempts are unauthenticated by definition), UI:N, S:U, C:N, I:L (log integrity/audit trail), A:N. Hmm but should I use PR:L to align with the
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
MISP's interactive CLI shell (versions ≤2.5.45) silently misattributes audit log entries when the CakePHP SysLogLogable singleton has its user context overwritten by a lazy-loaded model, causing privileged CLI writes to appear in the audit trail under the wrong user identity. Additionally, CLI-originated records lacked any distinguishing marker, making them indistinguishable from ordinary web-session actions in audit logs - a forensic and compliance problem for organizations relying on MISP's audit trail to attribute administrative activity. No public exploit exists and no active exploitation has been identified.
CyberPanel versions before 2.4.4 fail to record audit log entries when authenticated panel users interact with the child domains management interface, allowing configuration manipulation to proceed without any forensic trail. The upstream fix commit also reveals a companion access-control defect: a missing return path in the ACL ownership check (checkOwnership() in acl.py) and an ORM filter regression in fetchChildDomainsMain that broadened the child domain result set beyond intended alias-excluded entries. Together, these gaps allow an authenticated low-privilege user to alter domain list state silently, undermining post-incident accountability. No public exploit has been identified at time of analysis.
Insufficient audit logging in Microsoft SQL Server 2022 and 2025 allows a low-privileged authenticated attacker to bypass a security control over the network, resulting in high-confidentiality data access without a corresponding audit trail. Affected versions span both the GDR and Cumulative Update branches of SQL Server 2022 (pre-16.0.4275.2 / pre-16.0.1200.5) and SQL Server 2025 (pre-17.0.4085.5 / pre-17.0.1135.8). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected servicing branches.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.