Vulnerabilities in ntop
12 resultsCVE-2026-82413HIGHntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)EPSS 1.1%CVE-2026-82412HIGHntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIEPSS 0.7%CVE-2026-86098HIGHntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escapeEPSS 0.6%CVE-2026-83621HIGHntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsEPSS 0.5%CVE-2026-86091HIGHntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete HandlerEPSS 0.5%CVE-2026-97371MEDIUMntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packetsEPSS 0.5%CVE-2026-86090HIGHntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete HandlersEPSS 0.5%CVE-2026-116744MEDIUMntop nDPI through 6.0 Out-of-Bounds Read in SoftEther DissectorEPSS 0.4%CVE-2026-84989HIGHntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary TagsEPSS 0.4%CVE-2026-84990HIGHntopng: Missing Authorization on System Configuration Backup Download and ListingEPSS 0.3%CVE-2025-25066HIGHnDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.EPSS 0.2%CVE-2026-45448MEDIUMntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.2%