# cve.now: Nozomi Networks

The newest entries naming Nozomi Networks as an affected vendor (up to 200), of 63 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-33924](https://cve.now/CVE-2026-33924.md): Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 (CVSS 7.5)
- [CVE-2026-33923](https://cve.now/CVE-2026-33923.md): Update bundle signature bypass in Guardian/CMC before 26.4.0 (CVSS 7.5)
- [CVE-2026-33920](https://cve.now/CVE-2026-33920.md): Cross-site request forgery in the Guardian/CMC login before 26.3.0 (CVSS 5.1)
- [CVE-2026-33391](https://cve.now/CVE-2026-33391.md): Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0 (CVSS 5.3)
- [CVE-2026-33389](https://cve.now/CVE-2026-33389.md): Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0 (CVSS 5.3)
- [CVE-2026-33388](https://cve.now/CVE-2026-33388.md): Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0 (CVSS 6.4)
- [CVE-2026-33387](https://cve.now/CVE-2026-33387.md): Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0 (CVSS 5.1)
- [CVE-2026-33922](https://cve.now/CVE-2026-33922.md): Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0 (CVSS 6.8)
- [CVE-2026-33921](https://cve.now/CVE-2026-33921.md): Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0 (CVSS 4.8)
- [CVE-2026-33390](https://cve.now/CVE-2026-33390.md): Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (CVSS 7.2)
- [CVE-2026-31985](https://cve.now/CVE-2026-31985.md): Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0 (CVSS 8.3)
- [CVE-2026-31984](https://cve.now/CVE-2026-31984.md): DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (CVSS 8.7)
- [CVE-2026-31983](https://cve.now/CVE-2026-31983.md): Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 (CVSS 6.9)
- [CVE-2026-31982](https://cve.now/CVE-2026-31982.md): Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 (CVSS 5.3)
- [CVE-2026-31981](https://cve.now/CVE-2026-31981.md): HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 (CVSS 4.8)
- [CVE-2025-40904](https://cve.now/CVE-2025-40904.md): HTML injection in Smart Polling in Guardian/CMC before 26.1.0 (CVSS 5.1)
- [CVE-2025-40903](https://cve.now/CVE-2025-40903.md): HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0 (CVSS 4.8)
- [CVE-2025-40902](https://cve.now/CVE-2025-40902.md): HTML injection in Users in Guardian/CMC before 26.1.0 (CVSS 4.8)
- [CVE-2025-40901](https://cve.now/CVE-2025-40901.md): HTML injection in Credentials Manager in Guardian/CMC before 26.1.0 (CVSS 4.8)
- [CVE-2025-40900](https://cve.now/CVE-2025-40900.md): Angular template injection in Reports in Guardian/CMC before 26.1.0 (CVSS 5.1)
- [CVE-2025-40899](https://cve.now/CVE-2025-40899.md): Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0 (CVSS 7.1)
- [CVE-2025-40897](https://cve.now/CVE-2025-40897.md): Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 (CVSS 7.2)
- [CVE-2025-40896](https://cve.now/CVE-2025-40896.md): Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0 (CVSS 6.3)
- [CVE-2025-40895](https://cve.now/CVE-2025-40895.md): HTML injection in Sensor Map in CMC before 25.6.0 (CVSS 2.0)
- [CVE-2025-40894](https://cve.now/CVE-2025-40894.md): HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 (CVSS 2.1)
- [CVE-2025-40898](https://cve.now/CVE-2025-40898.md): Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 (CVSS 7.2)
- [CVE-2025-40893](https://cve.now/CVE-2025-40893.md): HTML injection in Asset List in Guardian/CMC before 25.5.0 (CVSS 5.3)
- [CVE-2025-40892](https://cve.now/CVE-2025-40892.md): Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0 (CVSS 7.1)
- [CVE-2025-40891](https://cve.now/CVE-2025-40891.md): HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0 (CVSS 2.3)
- [CVE-2025-40890](https://cve.now/CVE-2025-40890.md): Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0 (CVSS 5.8)
- [CVE-2025-40888](https://cve.now/CVE-2025-40888.md): Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0 (CVSS 6.0)
- [CVE-2025-40889](https://cve.now/CVE-2025-40889.md): Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 (CVSS 7.2)
- [CVE-2025-40887](https://cve.now/CVE-2025-40887.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 6.0)
- [CVE-2025-40886](https://cve.now/CVE-2025-40886.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 7.7)
- [CVE-2025-40885](https://cve.now/CVE-2025-40885.md): Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0 (CVSS 6.0)
- [CVE-2025-3719](https://cve.now/CVE-2025-3719.md): Incorrect authorization for CLI in Guardian/CMC before 25.2.0 (CVSS 7.2)
- [CVE-2025-3718](https://cve.now/CVE-2025-3718.md): Client-side path traversal in Guardian/CMC before 25.2.0 (CVSS 5.8)
- [CVE-2025-1501](https://cve.now/CVE-2025-1501.md): Incorrect authorization for traces request/download in CMC before 25.1.0 (CVSS 5.3)
- [CVE-2024-13090](https://cve.now/CVE-2024-13090.md): Privilege escalation in Guardian/CMC before 24.6.0 (CVSS 7.3)
- [CVE-2024-13089](https://cve.now/CVE-2024-13089.md): Authenticated RCE in update functionality in Guardian/CMC before 24.6.0 (CVSS 7.5)
- [CVE-2024-4465](https://cve.now/CVE-2024-4465.md): Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 (CVSS 6.0)
- [CVE-2023-5938](https://cve.now/CVE-2023-5938.md): Path traversal via 'zip slip' in Arc before v1.6.0 (CVSS 8.0)
- [CVE-2023-5937](https://cve.now/CVE-2023-5937.md): Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0 (CVSS 3.8)
- [CVE-2023-5936](https://cve.now/CVE-2023-5936.md): Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 (CVSS 7.8)
- [CVE-2023-5935](https://cve.now/CVE-2023-5935.md): Missing authentication for local web interface in Arc before v1.6.0 (CVSS 7.4)
- [CVE-2024-0218](https://cve.now/CVE-2024-0218.md): DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 (CVSS 7.5)
- [CVE-2023-6916](https://cve.now/CVE-2023-6916.md): Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 (CVSS 7.2)
- [CVE-2023-5253](https://cve.now/CVE-2023-5253.md): Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 (CVSS 5.3)
- [CVE-2023-32649](https://cve.now/CVE-2023-32649.md): DoS on IDS parsing of malformed asset fields in Guardian/CMC \>= 22.6.0 before 22.6.3 and 23.1.0 (CVSS 7.5)
- [CVE-2023-29245](https://cve.now/CVE-2023-29245.md): SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC \>= 22.6.0 before 22.6.3 and 23.1.0 (CVSS 8.1)
- [CVE-2023-2567](https://cve.now/CVE-2023-2567.md): Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 (CVSS 8.8)
- [CVE-2023-23903](https://cve.now/CVE-2023-23903.md): DoS via SAML configuration in Guardian/CMC before 22.6.2 (CVSS 4.9)
- [CVE-2023-24015](https://cve.now/CVE-2023-24015.md): Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 (CVSS 4.3)
- [CVE-2023-24471](https://cve.now/CVE-2023-24471.md): Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 (CVSS 6.5)
- [CVE-2023-22843](https://cve.now/CVE-2023-22843.md): Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 (CVSS 6.4)
- [CVE-2023-23574](https://cve.now/CVE-2023-23574.md): Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 (CVSS 8.8)
- [CVE-2023-22378](https://cve.now/CVE-2023-22378.md): Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 (CVSS 8.8)
- [CVE-2023-24477](https://cve.now/CVE-2023-24477.md): Session Fixation in Guardian/CMC before 22.6.2 (CVSS 7.0)
- [CVE-2022-4259](https://cve.now/CVE-2022-4259.md): Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 (CVSS 8.8)
- [CVE-2022-0551](https://cve.now/CVE-2022-0551.md): Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 (CVSS 7.2)
- [CVE-2022-0550](https://cve.now/CVE-2022-0550.md): Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 (CVSS 7.2)
- [CVE-2021-26724](https://cve.now/CVE-2021-26724.md): Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 (CVSS 8.6)
- [CVE-2021-26725](https://cve.now/CVE-2021-26725.md): Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nozomi-networks
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.