# Brocade SANnav. Every CVE that names Brocade SANnav among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Brocade SANnav: A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch…](https://agentprime.io/advisories/CVE-2026-5769.md) `CVE-2026-5769` · CVE record: Brocade Brocade SANnav · CVSS 5.6 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-313 - [Path traversal in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5049.md) `CVE-2026-5049` · CVE record: Brocade Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal - [SQL injection in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5048.md) `CVE-2026-5048` · CVE record: Brocade Brocade SANnav · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection - [Insecure storage of sensitive information in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-5047.md) `CVE-2026-5047` · CVE record: Brocade Brocade SANnav · CVSS 8.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure - [Incomplete property masking in the SANnav logging subsystem](https://agentprime.io/advisories/CVE-2026-85417.md) `CVE-2026-85417` · CVE record: Brocade SANnav · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure - [Logic flaw in SANnav Java cache key handling object comparison handling](https://agentprime.io/advisories/CVE-2026-14441.md) `CVE-2026-14441` · CVE record: Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-1025 - [Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-14442.md) `CVE-2026-14442` · CVE record: Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-14443.md) `CVE-2026-14443` · CVE record: Brocade SANnav · CVSS 8.4 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a](https://agentprime.io/advisories/CVE-2026-82372.md) `CVE-2026-82372` · CVE record: Brocade SANnav · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Plaintext exposure of sensitive authentication data in SANnav discovery service log files](https://agentprime.io/advisories/CVE-2026-82371.md) `CVE-2026-82371` · CVE record: Brocade SANnav · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure - [Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service](https://agentprime.io/advisories/CVE-2026-82370.md) `CVE-2026-82370` · CVE record: Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a](https://agentprime.io/advisories/CVE-2026-82369.md) `CVE-2026-82369` · CVE record: Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Improper access control in Brocade SANnav](https://agentprime.io/advisories/CVE-2026-82368.md) `CVE-2026-82368` · CVE record: Brocade SANnav · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [SQL queries with sensitive information printed in logs with Brocade SANnav before 3.0](https://agentprime.io/advisories/CVE-2025-12774.md) `CVE-2025-12774` · CVE record: Brocade SANnav · CVSS 4.6 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Information disclosure - [Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a](https://agentprime.io/advisories/CVE-2025-12773.md) `CVE-2025-12773` · CVE record: Brocade SANnav · CVSS 7.1 High · Not analysed yet · Published 3 Feb 2026 · Tags: Information disclosure - [Plaintext Switch admin login password is seen in Brocade SANnav support save](https://agentprime.io/advisories/CVE-2025-12772.md) `CVE-2025-12772` · CVE record: Brocade SANnav · CVSS 8.5 High · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure - [Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0](https://agentprime.io/advisories/CVE-2025-12679.md) `CVE-2025-12679` · CVE record: Brocade SANnav · CVSS 7.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure - [Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)](https://agentprime.io/advisories/CVE-2025-12680.md) `CVE-2025-12680` · CVE record: Brocade SANnav · CVSS 6.0 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure, CWE-256 - [Weak TLS Ciphers on Brocade SANnav OVA SSH port 22](https://agentprime.io/advisories/CVE-2024-4282.md) `CVE-2024-4282` · CVE record: Brocade Brocade SANnav · CVSS 8.2 High · Not analysed yet · Published 14 Feb 2025 · Tags: Weak cryptography or TLS - [Weak TLS Ciphers on Brocade SANnav port 443 & 18082](https://agentprime.io/advisories/CVE-2024-10405.md) `CVE-2024-10405` · CVE record: Brocade Brocade SANnav · CVSS 6.9 Medium · Not analysed yet · Published 14 Feb 2025 · Tags: Weak cryptography or TLS - [Docker implementation in Brocade SANnav is missing Audit Rules.](https://agentprime.io/advisories/CVE-2024-2240.md) `CVE-2024-2240` · CVE record: Brocade Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 14 Feb 2025 · Tags: Privilege escalation - [Brocade SANnav encryption key is logged in the debug logs](https://agentprime.io/advisories/CVE-2025-1053.md) `CVE-2025-1053` · CVE record: Brocade Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 14 Feb 2025 · Tags: Information disclosure - [Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave](https://agentprime.io/advisories/CVE-2024-10404.md) `CVE-2024-10404` · CVE record: Brocade Brocade SANnav · CVSS 5.5 Medium · Not analysed yet · Published 14 Feb 2025 · Tags: Information disclosure - [Brocade SANnav Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2022-43937.md) `CVE-2022-43937` · CVE record: Brocade SANnav · CVSS 5.7 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Information disclosure - [Brocade Fabric OS switch passwords when debugging is enabled](https://agentprime.io/advisories/CVE-2022-43936.md) `CVE-2022-43936` · CVE record: Brocade SANnav · CVSS 6.8 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Information disclosure - [Switch passwords and authorization IDs are printed in the embedded MLS DB file](https://agentprime.io/advisories/CVE-2022-43935.md) `CVE-2022-43935` · CVE record: Brocade SANnav · CVSS 5.3 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Information disclosure - [Weak Key-exchange algorithms](https://agentprime.io/advisories/CVE-2022-43934.md) `CVE-2022-43934` · CVE record: Brocade SANnav · CVSS 6.5 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Weak cryptography or TLS - [configuration secrets are logged in support-save](https://agentprime.io/advisories/CVE-2022-43933.md) `CVE-2022-43933` · CVE record: Brocade SANnav · CVSS 4.4 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Information disclosure - [Missing authentication in Brocade SAnnav](https://agentprime.io/advisories/CVE-2024-2860.md) `CVE-2024-2860` · CVE record: Brocade Brocade SAnnav · CVSS 7.8 High · Not analysed yet · Published 8 May 2024 · Tags: Authentication bypass - [By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)](https://agentprime.io/advisories/CVE-2024-2859.md) `CVE-2024-2859` · CVE record: Brocade Brocade SANnav · CVSS 6.8 Medium · Not analysed yet · Published 27 Apr 2024 · Tags: Broken access control - [SANnav versions exposes Kafka in the wan interface.](https://agentprime.io/advisories/CVE-2024-4173.md) `CVE-2024-4173` · CVE record: Brocade Brocade SANnav · CVSS 7.6 High · Not analysed yet · Published 25 Apr 2024 · Tags: Information disclosure - [Syslog traffic sent in clear-text](https://agentprime.io/advisories/CVE-2024-4161.md) `CVE-2024-4161` · CVE record: Brocade Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 25 Apr 2024 · Tags: Weak cryptography or TLS - [Protection mechanisms](https://agentprime.io/advisories/CVE-2024-4159.md) `CVE-2024-4159` · CVE record: Brocade Brocade SANnav · CVSS 4.3 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: Information disclosure - [TLS/SSL weak message authentication code ciphers are added by default for port 18082](https://agentprime.io/advisories/CVE-2024-29969.md) `CVE-2024-29969` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: Weak cryptography or TLS - [SQL Table names, column names, and SQL queries are collected in DR standby Supportsave](https://agentprime.io/advisories/CVE-2024-29968.md) `CVE-2024-29968` · CVE record: Brocade Brocade SANnav · CVSS 7.7 High · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points](https://agentprime.io/advisories/CVE-2024-29967.md) `CVE-2024-29967` · CVE record: Brocade Brocade SANnav · CVSS 4.4 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Broken access control - [hard-coded credentials in the documentation that appear as the appliance root password](https://agentprime.io/advisories/CVE-2024-29966.md) `CVE-2024-29966` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials - [Insecure backup](https://agentprime.io/advisories/CVE-2024-29965.md) `CVE-2024-29965` · CVE record: Brocade Brocade SANnav · CVSS 6.8 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files](https://agentprime.io/advisories/CVE-2024-29964.md) `CVE-2024-29964` · CVE record: Brocade Brocade SANnav · CVSS 5.7 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Broken access control - [Insecure file permission setting that makes files world-readable](https://agentprime.io/advisories/CVE-2024-29962.md) `CVE-2024-29962` · CVE record: Brocade Brocade SANnav · CVSS 5.5 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Broken access control - [Brocade SANnav contains hardcoded TLS keys used by Docker](https://agentprime.io/advisories/CVE-2024-29963.md) `CVE-2024-29963` · CVE record: Brocade Brocade SANnav · CVSS 1.9 Low · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials - [supply-chain attack risk](https://agentprime.io/advisories/CVE-2024-29961.md) `CVE-2024-29961` · CVE record: Brocade Brocade SANnav · CVSS 8.2 High · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [Identical SSH keys utilized inside the OVA image (CVE-2024-29960)](https://agentprime.io/advisories/CVE-2024-29960.md) `CVE-2024-29960` · CVE record: Brocade Brocade SANnav · CVSS 6.8 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials - [Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save](https://agentprime.io/advisories/CVE-2024-29959.md) `CVE-2024-29959` · CVE record: Brocade Brocade SANnav · CVSS 8.6 High · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [Encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node.](https://agentprime.io/advisories/CVE-2024-29958.md) `CVE-2024-29958` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [Encryption key is stored in the DR log files](https://agentprime.io/advisories/CVE-2024-29957.md) `CVE-2024-29957` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: Information disclosure - [cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav](https://agentprime.io/advisories/CVE-2024-29956.md) `CVE-2024-29956` · CVE record: Brocade Brocade SANnav · CVSS 6.5 Medium · Not analysed yet · Published 18 Apr 2024 · Tags: Information disclosure - [Insertion of Sensitive Information into Brocade SANnav Log File](https://agentprime.io/advisories/CVE-2024-29955.md) `CVE-2024-29955` · CVE record: Brocade Brocade SANnav · CVSS 5.0 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Information disclosure - [Clear text storage of sensistive information by manipulating command variables](https://agentprime.io/advisories/CVE-2024-29952.md) `CVE-2024-29952` · CVE record: Brocade Brocade SANnav · CVSS 5.5 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Information disclosure - [Brocade SANnav has weak encryption in internal SSH ports](https://agentprime.io/advisories/CVE-2024-29951.md) `CVE-2024-29951` · CVE record: Brocade Brocade SANnav · CVSS 5.7 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Weak cryptography or TLS - [Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption](https://agentprime.io/advisories/CVE-2024-29950.md) `CVE-2024-29950` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2024 · Tags: Weak cryptography or TLS - [Web authentication and authorization bypass](https://agentprime.io/advisories/CVE-2023-31424.md) `CVE-2023-31424` · CVE record: Brocade SANnav · CVSS 8.1 High · Not analysed yet · Published 31 Aug 2023 · Tags: Authentication bypass - [Possible information exposure through log file vulnerability](https://agentprime.io/advisories/CVE-2023-31423.md) `CVE-2023-31423` · CVE record: Brocade SANnav · CVSS 5.7 Medium · Not analysed yet · Published 31 Aug 2023 · Tags: Information disclosure - [Storage of clear text password in Brocade SANnav](https://agentprime.io/advisories/CVE-2023-31925.md) `CVE-2023-31925` · CVE record: Brocade Brocade SANnav · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2023 · Tags: Information disclosure - [Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs](https://agentprime.io/advisories/CVE-2022-33187.md) `CVE-2022-33187` · CVE record: Brocade Brocade SANnav · CVSS 5.5 Medium · Not analysed yet · Published 9 Dec 2022 · Tags: Information disclosure - [Brocade SANnav: In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8…](https://agentprime.io/advisories/CVE-2022-28168.md) `CVE-2022-28168` · CVE record: Brocade SANnav · No CVSS score · Not analysed yet · Published 27 Jun 2022 - [Brocade SANnav before Brocade SANvav v.](https://agentprime.io/advisories/CVE-2022-28167.md) `CVE-2022-28167` · CVE record: Brocade SANnav · No CVSS score · Not analysed yet · Published 27 Jun 2022 - [Brocade SANnav: In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8…](https://agentprime.io/advisories/CVE-2022-28166.md) `CVE-2022-28166` · CVE record: Brocade SANnav · No CVSS score · Not analysed yet · Published 27 Jun 2022 - [Brocade SANNav: An information exposure through log file vulnerability in Brocade SANNav versions before…](https://agentprime.io/advisories/CVE-2022-28161.md) `CVE-2022-28161` · CVE record: Brocade SANNav · No CVSS score · Not analysed yet · Published 9 May 2022 - [Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.](https://agentprime.io/advisories/CVE-2022-28162.md) `CVE-2022-28162` · CVE record: Brocade SANNav · No CVSS score · Not analysed yet · Published 9 May 2022 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .