Ntop vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-84990 ntopng is a web-based network traffic monitoring application.High 8.8 · Sep 21, 2026
• CVE-2026-83621 ntopng is a web-based network traffic monitoring application.High 8.1 · Sep 21, 2026
• CVE-2026-82412 ntopng is a web-based network traffic monitoring application.High 8.8 · Sep 21, 2026
• CVE-2026-86098 ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer bouHigh 8.3 · Sep 4, 2026
• CVE-2026-86091 ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools anHigh 7.1 · Sep 4, 2026
• CVE-2026-86090 ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers.High 7.1 · Sep 4, 2026
• CVE-2026-84989 ntopng is a web-based network traffic monitoring application.High 7.1 · Sep 3, 2026
• CVE-2026-38968 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking.Critical 9.8 · Jul 2, 2026
• CVE-2025-25066 nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.High 8.1 · Feb 3, 2025
• CVE-2021-36082 ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello.High 8.8 · Jun 30, 2021
• CVE-2020-15476 In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.High 7.5 · Jul 1, 2020
• CVE-2020-15475 In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.Critical 9.8 · Jul 1, 2020
• CVE-2020-15474 In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.Critical 9.8 · Jul 1, 2020
• CVE-2020-15473 In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.Critical 9.1 · Jul 1, 2020
• CVE-2020-15472 In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payloaCritical 9.1 · Jul 1, 2020
• CVE-2020-15471 In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.Critical 9.1 · Jul 1, 2020
• CVE-2020-11940 In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH pHigh 7.5 · Apr 23, 2020
• CVE-2020-11939 In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_stCritical 9.8 · Apr 23, 2020
• CVE-2018-12520 An issue was discovered in ntopng 3.4 before 3.4.180617.High 8.1 · Jul 5, 2018
• CVE-2017-7458 The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereferenHigh 7.5 · Jun 26, 2017
• CVE-2017-7459 ntopng before 3.0 allows HTTP Response Splitting.High 7.5 · Jun 26, 2017
• CVE-2017-5473 Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated bHigh 8.8 · Jan 14, 2017