Nozomi Networks Guardian
53 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-33924 | < 26.4.0 | Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 | HIGH 7.5 | 1.1 % | ||
| CVE-2026-33923 | < 26.4.0 | Update bundle signature bypass in Guardian/CMC before 26.4.0 | HIGH 7.5 | 0.2 % | ||
| CVE-2026-33920 | < 26.3.0 | Cross-site request forgery in the Guardian/CMC login before 26.3.0 | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-33391 | < 26.3.0 | Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0 | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-33389 | < 26.3.0 | Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0 | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-33388 | < 26.3.0 | Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0 | MEDIUM 6.4 | 0.4 % | ||
| CVE-2026-33387 | < 26.3.0 | Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-33390 | < 26.2.0 | Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 | HIGH 7.2 | 0.4 % | ||
| CVE-2026-31984 | < 26.2.0 | DoS through oversized audit log entries in Guardian/CMC before 26.2.0 | HIGH 8.7 | 0.5 % | ||
| CVE-2026-31983 | < 26.2.0 | Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-31982 | < 26.2.0 | Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-31981 | < 26.2.0 | HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-40904 | < 26.1.0 | HTML injection in Smart Polling in Guardian/CMC before 26.1.0 | MEDIUM 5.1 | 0.2 % | ||
| CVE-2025-40903 | < 26.1.0 | HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0 | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-40902 | < 26.1.0 | HTML injection in Users in Guardian/CMC before 26.1.0 | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-40901 | < 26.1.0 | HTML injection in Credentials Manager in Guardian/CMC before 26.1.0 | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-40900 | < 26.1.0 | Angular template injection in Reports in Guardian/CMC before 26.1.0 | MEDIUM 5.1 | 0.2 % | ||
| CVE-2025-40899 | < 26.0.0 | Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0 | HIGH 7.1 | 0.3 % | ||
| CVE-2025-40897 | < 26.0.0 | Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 | HIGH 7.2 | 0.3 % | ||
| CVE-2025-40894 | < 25.6.0 | HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0 | LOW 2.1 | 0.2 % | ||
| CVE-2025-40898 | < 25.5.0 | Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 | HIGH 7.2 | 0.4 % | ||
| CVE-2025-40893 | < 25.5.0 | HTML injection in Asset List in Guardian/CMC before 25.5.0 | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-40892 | < 25.5.0 | Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0 | HIGH 7.1 | 0.3 % | ||
| CVE-2025-40891 | < 25.5.0 | HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0 | LOW 2.3 | 0.2 % | ||
| CVE-2025-40890 | < 25.4.0 | Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0 | MEDIUM 5.9 | 0.2 % | ||
| CVE-2025-40888 | < 25.3.0 | Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0 | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-40889 | < 25.2.0 | Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 | HIGH 7.2 | 0.4 % | ||
| CVE-2025-40887 | < 25.2.0 | Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-40886 | < 25.2.0 | Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 | HIGH 7.7 | 0.3 % | ||
| CVE-2025-40885 | < 25.2.0 | Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0 | MEDIUM 6.0 | 0.2 % | ||
| CVE-2025-3719 | < 25.2.0 | Incorrect authorization for CLI in Guardian/CMC before 25.2.0 | HIGH 7.2 | 0.3 % | ||
| CVE-2025-3718 | < 25.2.0 | Client-side path traversal in Guardian/CMC before 25.2.0 | MEDIUM 5.9 | 0.2 % | ||
| CVE-2024-13090 | < 24.6.0 | Privilege escalation in Guardian/CMC before 24.6.0 | HIGH 7.3 | 0.1 % | ||
| CVE-2024-13089 | < 24.6.0 | Authenticated RCE in update functionality in Guardian/CMC before 24.6.0 | HIGH 7.5 | 1.0 % | ||
| CVE-2024-4465 | < 24.2.0 | Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 | MEDIUM 5.8 | 0.2 % | ||
| CVE-2024-0218 | < 23.4.1 | DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 | HIGH 8.2 | 0.6 % | ||
| CVE-2023-6916 | < 23.4.1 | Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 | HIGH 7.5 | 0.6 % | ||
| CVE-2023-5253 | < 23.3.0 | Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 | MEDIUM 6.3 | 0.5 % | ||
| CVE-2023-32649 | 22.6.0 – < 22.6.3 ; 23.0.0 – < 23.1.0 | DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 | HIGH 8.2 | 0.6 % | ||
| CVE-2023-29245 | 22.6.0 – < 22.6.3 ; 23.0.0 – < 23.1.0 | SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 | CRITICAL 9.2 | 0.6 % | ||
| CVE-2023-2567 | < 22.6.3 ; 23.0.0 – < 23.1.0 | Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 | HIGH 8.7 | 0.6 % | ||
| CVE-2023-23903 | < 22.6.2 | DoS via SAML configuration in Guardian/CMC before 22.6.2 | MEDIUM 6.9 | 0.6 % | ||
| CVE-2023-24015 | < 22.6.2 | Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-24471 | < 22.6.2 | Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 | HIGH 7.1 | 0.5 % | ||
| CVE-2023-22843 | < 22.6.2 | Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 | HIGH 7.3 | 0.3 % | ||
| CVE-2023-23574 | < 22.6.2 | Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 | HIGH 8.7 | 0.6 % | ||
| CVE-2023-22378 | < 22.6.2 | Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 | HIGH 8.7 | 0.6 % | ||
| CVE-2023-24477 | < 22.6.2 | Session Fixation in Guardian/CMC before 22.6.2 | MEDIUM 5.4 | 0.1 % | ||
| CVE-2022-4259 | < 22.5.2 | Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 | HIGH 8.7 | 0.6 % | ||
| CVE-2022-0551 | unspecified – < 22.0.0 | Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 | HIGH 8.6 | 0.9 % | ||
| CVE-2022-0550 | unspecified – < 22.0.0 | Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 | HIGH 8.6 | 0.9 % | ||
| CVE-2021-26724 | 20.0.7.3 and prior versions | Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 | HIGH 8.6 | 2.8 % | ||
| CVE-2021-26725 | 20.0.7.3 and prior versions | Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 | HIGH 8.6 | 1.1 % |