CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-82412 ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-82412 ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

UBUNTU-CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

EUVD-2026-83919

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-80110 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-94215

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215

Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...

CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

EUVD-2026-83841

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-80110: Incorrect Authorization

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

PT-2026-96043

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The API utilizes a per-request in-memory cache to resolve clients by their unique identifier but fails to verify if the client belongs to the...

CVE-2026-94215: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-82412: Improper Neutralization of Special Elements used in an OS Command

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...