Nixpkgs security tracker

Published

Permalink CVE-2026-86091

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

References

GitHub Security Advisory (GHSA-m22w-f647-vx88) vendor-advisory
Patch Commit patch
https://github.com/ntop/ntopng product
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/sc… technical-description
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/sc… technical-description
VulnCheck Advisory: ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler third-party-advisory

Affected products

ntopng

<6.7.260717

Matching in nixpkgs

pkgs.ntopng

High-speed web-based traffic analysis and flow collection tool

nixos-unstable 6.6
- nixpkgs-unstable 6.6
- nixos-unstable-small 6.6
nixos-26.05 6.6
- nixos-26.05-small 6.6
- nixpkgs-26.05-darwin 6.6

Package maintainers

@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>

Published

Permalink CVE-2026-86090

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

References

GitHub Security Advisory (GHSA-m22w-f647-vx88) vendor-advisory
Patch Commit patch
https://github.com/ntop/ntopng product
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/sc… technical-description
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/sc… technical-description
VulnCheck Advisory: ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers third-party-advisory

Affected products

ntopng

<6.7.260717

Matching in nixpkgs

pkgs.ntopng

High-speed web-based traffic analysis and flow collection tool

nixos-unstable 6.6
- nixpkgs-unstable 6.6
- nixos-unstable-small 6.6
nixos-26.05 6.6
- nixos-26.05-small 6.6
- nixpkgs-26.05-darwin 6.6

Package maintainers

@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>

Dismissed

Permalink CVE-2026-84989

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 1 week, 2 days ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse dismissed 1 week, 2 days ago

ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

References

https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8 exploitx_refsource_CONFIRM
https://github.com/ntop/ntopng/commit/0e41f24b367fb9caf750459da67827326e3289e8 x_refsource_MISC

Affected products

ntopng

==>= 6.7.0, < 6.7.260718

Matching in nixpkgs

pkgs.ntopng

High-speed web-based traffic analysis and flow collection tool

nixos-unstable 6.6
- nixpkgs-unstable 6.6
- nixos-unstable-small 6.6
nixos-26.05 6.6
- nixos-26.05-small 6.6
- nixpkgs-26.05-darwin 6.6

Package maintainers

@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>

Not in the impacted version range.

Untriaged

Permalink CVE-2026-45448

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 months, 4 weeks ago Activity log

Created suggestion 3 months, 4 weeks ago

ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

CWE-601 URL redirection to untrusted site ('open redirect')

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip…

Affected products

ntopng

==ntopng-6.7.251215

Matching in nixpkgs

pkgs.ntopng

High-speed web-based traffic analysis and flow collection tool

nixos-unstable 6.6
- nixos-unstable-small 6.6

Package maintainers

@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.ntopng

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.ntopng

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.ntopng

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.ntopng

Package maintainers