ntopng
- Software type
- Network management
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/22/2026, ntopng recorded 6 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of ntopng and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-84990ntopng: Missing Authorization on System Configuration Backup Download and ListingCVE-2026-83621ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsCVE-2026-82412ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APICVE-2026-86091ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete HandlerCVE-2026-86090ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-84990ntopng: Missing Authorization on System Configuration Backup Download and Listing | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-83621ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs | Exploitation statusNot exploited | FixYes | Published09/21/2026 | SeverityHigh |
|---|
CVE-2026-82412ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API | Exploitation statusNot exploited | FixYes | Published09/21/2026 | SeverityHigh |
|---|
CVE-2026-86091ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler | Exploitation statusActively exploited | FixYes | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-86090ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers | Exploitation statusNot exploited | FixYes | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-84989ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags | Exploitation statusActively exploited | FixNo | Published09/03/2026 | SeverityHigh |
|---|
CVE-2026-38968CVE-2026-38968 | Exploitation statusNot exploited | FixNo | Published07/02/2026 | SeverityCritical |
|---|
CVE-2026-45448ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') | Exploitation statusNot exploited | FixYes | Published05/14/2026 | SeverityMedium |
|---|
CVE-2024-53426CVE-2024-53426 | Exploitation statusActively exploited | FixNo | Published11/21/2024 | SeverityMedium |
|---|
CVE-2018-12520CVE-2018-12520 | Exploitation statusActively exploited | FixNo | Published07/05/2018 | SeverityUnknown |
|---|
17 Results | Page 1 of 2