Ntop vulnerabilities

Products

• Ntopng 19
• Ndpi 12
• Ntop 2

Newest

• ntop ntopng ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets CVE-2026-97371 5.3 MediumNovember 5, 2026
• ntop ntopng ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) CVE-2026-82413 8.8 HighNovember 5, 2026
• ntop ndpi ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector CVE-2026-116744 6.9 MediumOctober 26, 2026
• ntop ntopng ntopng: Missing Authorization on System Configuration Backup Download and Listing CVE-2026-84990 8.8 HighSeptember 21, 2026
• ntop ntopng ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs CVE-2026-83621 8.1 HighSeptember 21, 2026
• ntop ntopng ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API CVE-2026-82412 8.8 HighSeptember 21, 2026
• ntop ndpi ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape CVE-2026-86098 Fix available 8.3 HighSeptember 4, 2026
• ntop ntopng ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler CVE-2026-86091 Fix available 7.1 HighSeptember 4, 2026
• ntop ntopng ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers CVE-2026-86090 Fix available 7.1 HighSeptember 4, 2026
• ntop ntopng ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVE-2026-84989 7.1 HighSeptember 3, 2026
• ntop ntopng ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session... CVE-2026-38968 Fix available 9.8 CriticalJuly 2, 2026
• ntop ntopng ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CVE-2026-45448 4.3 MediumMay 14, 2026
• ntop ndpi nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in... CVE-2025-25066 8.1 HighFebruary 3, 2025
• ntop ntopng A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS... CVE-2024-53426 6.2 MediumNovember 21, 2024
• ntop ndpi ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. CVE-2021-36082 Fix available 8.8 HighJuly 1, 2021
• ntop ndpi In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in... CVE-2020-15471 Fix available 9.1 CriticalJuly 1, 2020
• ntop ndpi, debian linux +1 more In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in... CVE-2020-15472 Fix available 9.1 CriticalJuly 1, 2020
• ntop ndpi In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in... CVE-2020-15473 Fix available 9.1 CriticalJuly 1, 2020
• ntop ndpi In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. CVE-2020-15474 Fix available 9.8 CriticalJuly 1, 2020
• ntop ndpi In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain... CVE-2020-15475 Fix available 9.8 CriticalJuly 1, 2020
• ntop ndpi, debian linux +1 more In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in... CVE-2020-15476 Fix available 7.5 HighJuly 1, 2020
• ntop ndpi In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited... CVE-2020-11940 Fix available 7.5 HighApril 23, 2020
• ntop ndpi In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows... CVE-2020-11939 Fix available 9.8 CriticalApril 23, 2020
• ntop ntopng An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of... CVE-2018-12520 Public exploitFix available EPSS 10.5% 8.1 HighJuly 5, 2018
• ntop ntopng The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote... CVE-2017-7458 7.5 HighJune 26, 2017
• ntop ntopng ntopng before 3.0 allows HTTP Response Splitting. CVE-2017-7459 7.5 HighJune 26, 2017
• ntop ntopng ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated. CVE-2017-7416 6.1 MediumJune 26, 2017
• ntop ntopng Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to... CVE-2017-5473 Public exploit 8.8 HighJanuary 14, 2017
• ntop ntopng ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and... CVE-2015-8368 Public exploit 6.0 MediumDecember 17, 2015
• ntop ntopng Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng ... CVE-2014-5464 Public exploit 4.3 MediumSeptember 8, 2014
• ntop ntopng Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote... CVE-2014-4329 4.3 MediumJune 19, 2014
• ntop, opensuse +1 more Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web... CVE-2014-4165 Fix available 4.3 MediumJune 16, 2014
• ntop The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier allows remote attackers to... CVE-2009-2732 Public exploit 5.0 MediumAugust 20, 2009