Ntopng
18 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Ntopng, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.
Ntopng CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 0 |
| 2026-09 | 6 |
Severity
How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High11
- Medium5
Latest CVEs
The 15 most recently published vulnerabilities affecting Ntopng.
- CVE-2026-84990ntopng: Missing Authorization on System Configuration Backup Download and Listing8.8
- CVE-2026-83621ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs8.1
- CVE-2026-82412ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API8.8
- CVE-2026-86091ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler7.1
- CVE-2026-86090ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers7.1
- CVE-2026-84989ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags7.1
- CVE-2026-38968ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during ...9.8
- CVE-2026-45448ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')4.3
- BDU:2020-05515Уязвимость программного средства мониторинга трафика в сети ntopng, связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить произвольный код9.8
- BDU:2020-05514Уязвимость программного средства мониторинга трафика в сети ntopng, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании7.5
- CVE-2018-12520An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocat...8.1
- CVE-2017-7458The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empt...7.5
- CVE-2017-7459ntopng before 3.0 allows HTTP Response Splitting.7.5
- CVE-2017-7416ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.6.1
- CVE-2017-5473Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_us...8.8
Product grouping is registry-driven, with AI assist and human review. How it works