UBUNTU-CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-84989 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

EUVD-2026-70502

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717 , two REST v2 endpoints managing the tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check . Any authenticated non-administ...

CVE-2026-84989 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-84989 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-80515

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in its REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation, allowing an unauthenticat...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

EUVD-2026-70479

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...

CVE-2026-74768

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery SSRF vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-74769

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

hulak v0.3.33

Hulak Your messenger in the terminal. Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive hulak run ./requests/ Hulak runs request files directly from your project. It supports concurrent directory execution. It falls back to an...

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 contains an unsafe deserialization flaw in its privileged REST import workflow. Because attacker-controlled data is deserialized without adequate validation, an attacker holding a privileged API token can achieve arbitrary command execution with nobody ...

CVE-2026-84832 Unsafe deserialization in the REST interface

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...