ntopng

Repository description, written by its ownerWeb-based Traffic and Cybersecurity Network Traffic Monitoring

Active last commit today

Commits in 52 of the last 52 weeks

Security advisories

Advisories the maintainers published on GitHub. Vulnerabilities reported only elsewhere, for example in the NVD, are not included.

GHSA-5xr5-wqhx-fpxm High Oct 8, 2026
An sFlow datagram with an unbounded MPLS label-stack depth reads past the buffer
GHSA-89wv-w893-9fvq High Oct 8, 2026
Stored XSS via network-harvested host names in the Hosts view
GHSA-7gqm-qqf6-8wxq High Sep 23, 2026
[XBOW-025-118] Cross-Site Scripting in ntopng Login Page Using RTL Override
GHSA-p4gm-6qx7-gq3m Medium Aug 3, 2026
OS command injection in vulnerability scan exec_netscan via host parameter (incomplete fix bypass)
GHSA-26jm-9qfw-89w7 CVE-2026-97371 Medium Jul 21, 2026
Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets
GHSA-43p9-5758-wwq8 CVE-2026-84989 High Jul 17, 2026
Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags
GHSA-7gqc-vjwr-6rh5 CVE-2026-84990 High Jul 17, 2026
Missing Authorization on System Configuration Backup Download and Listing
GHSA-2c6p-4pfj-qv58 CVE-2026-82412 High Jul 16, 2026
Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
GHSA-9xj6-f266-r46p CVE-2026-82413 High Jul 16, 2026
Authenticated (Non-Admin) Users Can Run Vulnerability-Scan
GHSA-m22w-f647-vx88 High Jul 16, 2026
Missing Authorization in REST API Allows Non-Admin Users to Delete All Notification Endpoints, Recipients, and Host Pools
GHSA-ffg5-889g-f5q8 CVE-2026-83621 High Jul 16, 2026
Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs