Ntopng

This hub aggregates every CVE we track for Ntopng, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Ntopng.

• CVE-2026-86091ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler7.1Sep 4, 2026
• CVE-2026-86090ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers7.1Sep 4, 2026
• CVE-2026-84989ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags7.1Sep 3, 2026
• CVE-2026-38968ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during ...9.8Jul 2, 2026
• CVE-2026-45448ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')4.3May 14, 2026
• BDU:2020-05515Уязвимость программного средства мониторинга трафика в сети ntopng, связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить произвольный код9.8Dec 1, 2020
• BDU:2020-05514Уязвимость программного средства мониторинга трафика в сети ntopng, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании7.5Dec 1, 2020
• CVE-2018-12520An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocat...8.1Jul 5, 2018
• CVE-2017-7458The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empt...7.5Jun 26, 2017
• CVE-2017-7459ntopng before 3.0 allows HTTP Response Splitting.7.5Jun 26, 2017
• CVE-2017-7416ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.6.1Jun 26, 2017
• CVE-2017-5473Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_us...8.8Jan 14, 2017
• CVE-2015-8368ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.6.0Dec 17, 2015
• CVE-2014-5464Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Hos...4.3Sep 8, 2014
• CVE-2014-4329Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.4.3Jun 19, 2014