Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-84990 · Other software · ntop · reported by GitHubHigh 8.8
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-83621 · Other software · ntop · reported by GitHubHigh 8.1
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-82412 · Other software · ntop · reported by GitHubHigh 8.8
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools anCVE-2026-86091 · Other software · ntop · reported by VulnCheckHigh 7.1
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers.CVE-2026-86090 · Other software · ntop · reported by VulnCheckHigh 7.1
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-84989 · Other software · ntop · reported by GitHubHigh 7.1
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking.CVE-2026-38968 · Other software · Ntop · reported by MITRECritical 9.8
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026CWE-601 URL redirection to untrusted site ('open redirect')CVE-2026-45448 · Other software · ntop · reported by cna@cyber.gov.ilMedium 4.3
CWE-601 URL redirection to untrusted site ('open redirect')
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.CVE-2024-53426 · Other software · ntop · reported by MITREMedium 6.2
A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2018An issue was discovered in ntopng 3.4 before 3.4.180617.CVE-2018-12520 · Other software · Ntop · reported by MITREHigh 8.1
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggist.github.com
Jun 26, 2017The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereferenCVE-2017-7458 · Other software · Ntop · reported by MITREHigh 7.5
The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2017ntopng before 3.0 allows HTTP Response Splitting.CVE-2017-7459 · Other software · Ntop · reported by MITREHigh 7.5
ntopng before 3.0 allows HTTP Response Splitting.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2017ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.CVE-2017-7416 · Other software · Ntop · reported by MITREMedium 6.1
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2017Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated bCVE-2017-5473 · Other software · Ntop · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 17, 2015ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admCVE-2015-8368 · Other software · Ntop · reported by MITREMedium 6
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 8, 2014Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrarCVE-2014-5464 · Other software · Ntop · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Jun 19, 2014Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host paramCVE-2014-4329 · Other software · Ntop · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
- Product
- Ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comntop.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.