CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

Linux Distros Unpatched Vulnerability : CVE-2026-86090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...

CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

PT-2026-86263

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-86090: Missing Authorization

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

UBUNTU-CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

PT-2026-85056

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-84989: Missing Authorization

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated...

CVE-2026-77757

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.5-8.9.2 is vulnerable to an Arbitrary Image Move vulnerability. The root cause is a failure to sanitize user-supplied image references used as the source for a file move operation during REST v2 ...