NT
Vendor
ntop
31
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116744 New | ND nDPI ntop | 5.3 | Oct 26 | ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector |
| CVE-2026-84990 | NT ntopng ntop | 8.8 | Sep 21 | ntopng: Missing Authorization on System Configuration Backup Download and Listing |
| CVE-2026-83621 | NT ntopng ntop | 8.1 | Sep 21 | ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs |
| CVE-2026-82412 | NT ntopng ntop | 8.8 | Sep 21 | ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API |
| CVE-2026-86098 | ND nDPI ntop | 7.4 | Sep 4 | ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape |
| CVE-2026-86091 | NT ntopng ntop | 7.1 | Sep 4 | ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler |
| CVE-2026-86090 | NT ntopng ntop | 7.1 | Sep 4 | ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers |
| CVE-2026-84989 | NT ntopng ntop | 7.1 | Sep 3 | ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags |
| CVE-2026-38968 | NT Ntopng Ntop | 9.8 | Jul 2 | ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking |
| CVE-2026-45448 | NT ntopng ntop | 4.3 | May 14 | ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
| CVE-2025-25066 | ND nDPI ntop | 8.4 | Feb 3 | nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c |
| CVE-2024-53426 | NT Ntopng Ntop | 6.2 | Nov 21 | A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function |
| CVE-2021-36082 | ND Ndpi Ntop | 8.8 | Jul 1 | ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello |
| CVE-2020-15476 | ND Ndpi Ntop | 7.5 | Jul 1 | In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c |
| CVE-2020-15475 | ND Ndpi Ntop | 9.8 | Jul 1 | In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free |
| CVE-2020-15474 | ND Ndpi Ntop | 9.8 | Jul 1 | In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c |
| CVE-2020-15473 | ND Ndpi Ntop | 9.1 | Jul 1 | In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c |
| CVE-2020-15472 | ND Ndpi Ntop | 9.1 | Jul 1 | In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length… |
| CVE-2020-15471 | ND Ndpi Ntop | 9.1 | Jul 1 | In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c |
| CVE-2020-11940 | ND Ndpi Ntop | 7.5 | Apr 23 | In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on… |
| CVE-2020-11939 | ND Ndpi Ntop | 9.8 | Apr 23 | In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c |
| CVE-2018-12520 | NT Ntopng Ntop | 8.1 | Jul 5 | An issue was discovered in ntopng 3.4 before 3.4.180617 |
| CVE-2017-7458 | NT Ntopng Ntop | 7.5 | Jun 26 | The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application… |
| CVE-2017-7459 | NT Ntopng Ntop | 7.5 | Jun 26 | ntopng before 3.0 allows HTTP Response Splitting |
| CVE-2017-7416 | NT Ntopng Ntop | 6.1 | Jun 26 | ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated |
| CVE-2017-5473 | NT Ntopng Ntop | 8.8 | Jan 14 | Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by… |
| CVE-2015-8368 | NT Ntopng Ntop | – | Dec 17 | ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to… |
| CVE-2014-5464 | NT Ntopng Ntop | – | Sep 8 | Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or… |
| CVE-2014-4329 | NT Ntopng Ntop | – | Jun 19 | Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter |
| CVE-2014-4165 | NT Ntop Ntop | – | Jun 16 | Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the title parameter in a list action to plugins/rrdPlugin |
| CVE-2009-2732 | NT Ntop Ntop | – | Aug 21 | The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an… |