Ntop Ntopng vulnerabilities

• ntop ntopng ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets CVE-2026-97371 5.3 MediumNovember 5, 2026
• ntop ntopng ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) CVE-2026-82413 8.8 HighNovember 5, 2026
• ntop ntopng ntopng: Missing Authorization on System Configuration Backup Download and Listing CVE-2026-84990 8.8 HighSeptember 21, 2026
• ntop ntopng ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs CVE-2026-83621 8.1 HighSeptember 21, 2026
• ntop ntopng ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API CVE-2026-82412 8.8 HighSeptember 21, 2026
• ntop ntopng ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler CVE-2026-86091 Fix available 7.1 HighSeptember 4, 2026
• ntop ntopng ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers CVE-2026-86090 Fix available 7.1 HighSeptember 4, 2026
• ntop ntopng ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVE-2026-84989 7.1 HighSeptember 3, 2026
• ntop ntopng ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session... CVE-2026-38968 Fix available 9.8 CriticalJuly 2, 2026
• ntop ntopng ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CVE-2026-45448 4.3 MediumMay 14, 2026
• ntop ntopng A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS... CVE-2024-53426 6.2 MediumNovember 21, 2024
• ntop ntopng An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of... CVE-2018-12520 Public exploitFix available EPSS 10.5% 8.1 HighJuly 5, 2018
• ntop ntopng The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote... CVE-2017-7458 7.5 HighJune 26, 2017
• ntop ntopng ntopng before 3.0 allows HTTP Response Splitting. CVE-2017-7459 7.5 HighJune 26, 2017
• ntop ntopng ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated. CVE-2017-7416 6.1 MediumJune 26, 2017
• ntop ntopng Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to... CVE-2017-5473 Public exploit 8.8 HighJanuary 14, 2017
• ntop ntopng ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and... CVE-2015-8368 Public exploit 6.0 MediumDecember 17, 2015
• ntop ntopng Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng ... CVE-2014-5464 Public exploit 4.3 MediumSeptember 8, 2014
• ntop ntopng Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote... CVE-2014-4329 4.3 MediumJune 19, 2014