Nozomi Networks CMC

• CVE-2026-33924 High 7.2 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 1.1%
• CVE-2026-33923 High 7.2 Update bundle signature bypass in Guardian/CMC before 26.4.0 0.2%
• CVE-2026-33920 Low 3.5 Cross-site request forgery in the Guardian/CMC login before 26.3.0 0.1%
• CVE-2026-33391 Medium 5.4 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0 0.4%
• CVE-2026-33389 High 7.5 Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0 0.2%
• CVE-2026-33388 High 7.4 Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0 0.4%
• CVE-2026-33387 Medium 4.6 Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0 0.3%
• CVE-2026-33390 High 8.1 Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 0.4%
• CVE-2026-31984 High 7.5 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 0.5%
• CVE-2026-31983 Medium 5.3 Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 0.4%
• CVE-2026-31982 High 7.1 Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 0.3%
• CVE-2026-31981 Medium 5.9 HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 0.3%
• CVE-2025-40904 Medium 6.5 HTML injection in Smart Polling in Guardian/CMC before 26.1.0 0.2%
• CVE-2025-40903 Medium 5.9 HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0 0.2%
• CVE-2025-40902 Medium 5.9 HTML injection in Users in Guardian/CMC before 26.1.0 0.2%
• CVE-2025-40901 Medium 5.9 HTML injection in Credentials Manager in Guardian/CMC before 26.1.0 0.2%
• CVE-2025-40900 Medium 4.6 Angular template injection in Reports in Guardian/CMC before 26.1.0 0.2%
• CVE-2025-40899 High 8.9 Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0 0.3%
• CVE-2025-40897 High 8.1 Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 0.3%
• CVE-2025-40895 Medium 4.8 HTML injection in Sensor Map in CMC before 25.6.0 0.2%
• CVE-2025-40894 Medium 4.4 HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 0.2%
• CVE-2025-40898 High 8.1 Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 0.4%
• CVE-2025-40893 Medium 6.1 HTML injection in Asset List in Guardian/CMC before 25.5.0 0.2%
• CVE-2025-40892 High 8.9 Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0 0.3%
• CVE-2025-40891 Medium 4.7 HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0 0.2%
• CVE-2025-40890 High 7.9 Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0 0.2%
• CVE-2025-40888 Medium 5.3 Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0 0.2%
• CVE-2025-40889 High 8.1 Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 0.4%
• CVE-2025-40887 Medium 5.3 Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 0.2%
• CVE-2025-40886 High 7.5 Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 0.3%
• CVE-2025-40885 Medium 5.3 Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0 0.2%
• CVE-2025-3719 High 8.1 Incorrect authorization for CLI in Guardian/CMC before 25.2.0 0.3%
• CVE-2025-3718 High 7.9 Client-side path traversal in Guardian/CMC before 25.2.0 0.2%
• CVE-2025-1501 Medium 4.3 Incorrect authorization for traces request/download in CMC before 25.1.0 0.2%
• CVE-2024-13090 High 7.0 Privilege escalation in Guardian/CMC before 24.6.0 0.1%
• CVE-2024-13089 High 7.2 Authenticated RCE in update functionality in Guardian/CMC before 24.6.0 1.1%
• CVE-2024-4465 Medium 6.0 Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 0.2%
• CVE-2023-6916 High 7.2 Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 0.6%
• CVE-2023-5253 Medium 5.3 Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 0.5%
• CVE-2023-32649 High 7.5 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 0.6%
• CVE-2023-29245 High 8.1 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 0.6%
• CVE-2023-2567 High 8.8 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 0.6%
• CVE-2023-23903 Medium 4.9 DoS via SAML configuration in Guardian/CMC before 22.6.2 0.6%
• CVE-2023-24015 Medium 4.3 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 0.5%
• CVE-2023-24471 Medium 6.5 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 0.5%
• CVE-2023-22843 Medium 6.4 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 0.3%
• CVE-2023-23574 High 8.8 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 0.6%
• CVE-2023-22378 High 8.8 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 0.6%
• CVE-2023-24477 High 7.0 Session Fixation in Guardian/CMC before 22.6.2 0.1%
• CVE-2022-4259 High 8.8 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 0.6%