NT
Product
ntopng
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 3Low 0
Watch
Add ntopng to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-38968 | 9.8 | Jul 2 | ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking Affected: through 6.6 |
| CVE-2026-84990 | 8.8 | Sep 21 | ntopng: Missing Authorization on System Configuration Backup Download and Listing Affected: < 6.7.260718 |
| CVE-2026-82412 | 8.8 | Sep 21 | ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API Affected: < 6.7.260717 |
| CVE-2017-5473 | 8.8 | Jan 14 | Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by… Affected: through 2.4 |
| CVE-2026-83621 | 8.1 | Sep 21 | ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs Affected: < 6.7.260717 |
| CVE-2018-12520 | 8.1 | Jul 5 | An issue was discovered in ntopng 3.4 before 3.4.180617 Affected: 3.4 before 3.4.180617 |
| CVE-2017-7458 | 7.5 | Jun 26 | The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application… Affected: through 2.4 |
| CVE-2017-7459 | 7.5 | Jun 26 | ntopng before 3.0 allows HTTP Response Splitting Affected: through 2.4 |
| CVE-2026-86091 | 7.1 | Sep 4 | ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler Affected: before 6.7.260717 |
| CVE-2026-86090 | 7.1 | Sep 4 | ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers Affected: before 6.7.260717 |
| CVE-2026-84989 | 7.1 | Sep 3 | ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags Affected: >= 6.7.0, < 6.7.260718 |
| CVE-2024-53426 | 6.2 | Nov 21 | A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function Affected: 6.2 |
| CVE-2017-7416 | 6.1 | Jun 26 | ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated Affected: through 2.4 |
| CVE-2026-45448 | 4.3 | May 14 | ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') Affected: ntopng-6.7.251215 |
| CVE-2015-8368 | – | Dec 17 | ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to… Affected: through 2.0.151021 |
| CVE-2014-5464 | – | Sep 8 | Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or… Affected: through 1.2.0; 1.1 |
| CVE-2014-4329 | – | Jun 19 | Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter Affected: 1.1 |
Showing 17