# Nozomi Networks CMC.

Every CVE that names Nozomi Networks CMC among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Authenticated RCE in update functionality in Guardian/CMC before 26.4.0](https://agentprime.io/advisories/CVE-2026-33924.md)
  `CVE-2026-33924` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection
- [Update bundle signature bypass in Guardian/CMC before 26.4.0](https://agentprime.io/advisories/CVE-2026-33923.md)
  `CVE-2026-33923` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS
- [Cross-site request forgery in the Guardian/CMC login before 26.3.0](https://agentprime.io/advisories/CVE-2026-33920.md)
  `CVE-2026-33920` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0](https://agentprime.io/advisories/CVE-2026-33391.md)
  `CVE-2026-33391` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0](https://agentprime.io/advisories/CVE-2026-33389.md)
  `CVE-2026-33389` · CVE record: Nozomi Networks Guardian and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-671
- [Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0](https://agentprime.io/advisories/CVE-2026-33388.md)
  `CVE-2026-33388` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0](https://agentprime.io/advisories/CVE-2026-33387.md)
  `CVE-2026-33387` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-33390.md)
  `CVE-2026-33390` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [DoS through oversized audit log entries in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-31984.md)
  `CVE-2026-31984` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service
- [Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-31983.md)
  `CVE-2026-31983` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Authentication bypass
- [Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-31982.md)
  `CVE-2026-31982` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Open redirect
- [HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-31981.md)
  `CVE-2026-31981` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS)
- [HTML injection in Smart Polling in Guardian/CMC before 26.1.0](https://agentprime.io/advisories/CVE-2025-40904.md)
  `CVE-2025-40904` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS)
- [HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0](https://agentprime.io/advisories/CVE-2025-40903.md)
  `CVE-2025-40903` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS)
- [HTML injection in Users in Guardian/CMC before 26.1.0](https://agentprime.io/advisories/CVE-2025-40902.md)
  `CVE-2025-40902` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS)
- [HTML injection in Credentials Manager in Guardian/CMC before 26.1.0](https://agentprime.io/advisories/CVE-2025-40901.md)
  `CVE-2025-40901` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS)
- [Angular template injection in Reports in Guardian/CMC before 26.1.0](https://agentprime.io/advisories/CVE-2025-40900.md)
  `CVE-2025-40900` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 19 May 2026 · Tags: Code injection
- [Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0](https://agentprime.io/advisories/CVE-2025-40899.md)
  `CVE-2025-40899` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.1 High · Not analysed yet · Published 15 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0](https://agentprime.io/advisories/CVE-2025-40897.md)
  `CVE-2025-40897` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 15 Apr 2026 · Tags: Broken access control
- [HTML injection in Sensor Map in CMC before 25.6.0](https://agentprime.io/advisories/CVE-2025-40895.md)
  `CVE-2025-40895` · CVE record: Nozomi Networks CMC · CVSS 2.0 Low · Not analysed yet · Published 4 Mar 2026 · Tags: Cross-site scripting (XSS)
- [HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0](https://agentprime.io/advisories/CVE-2025-40894.md)
  `CVE-2025-40894` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 2.1 Low · Not analysed yet · Published 4 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0](https://agentprime.io/advisories/CVE-2025-40898.md)
  `CVE-2025-40898` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 18 Dec 2025 · Tags: Path traversal
- [HTML injection in Asset List in Guardian/CMC before 25.5.0](https://agentprime.io/advisories/CVE-2025-40893.md)
  `CVE-2025-40893` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0](https://agentprime.io/advisories/CVE-2025-40892.md)
  `CVE-2025-40892` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site scripting (XSS)
- [HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0](https://agentprime.io/advisories/CVE-2025-40891.md)
  `CVE-2025-40891` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 2.3 Low · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0](https://agentprime.io/advisories/CVE-2025-40890.md)
  `CVE-2025-40890` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0](https://agentprime.io/advisories/CVE-2025-40888.md)
  `CVE-2025-40888` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: SQL injection
- [Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-40889.md)
  `CVE-2025-40889` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2025 · Tags: Path traversal
- [Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-40887.md)
  `CVE-2025-40887` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: SQL injection
- [Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-40886.md)
  `CVE-2025-40886` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2025 · Tags: SQL injection
- [Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-40885.md)
  `CVE-2025-40885` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: SQL injection
- [Incorrect authorization for CLI in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-3719.md)
  `CVE-2025-3719` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2025 · Tags: Broken access control
- [Client-side path traversal in Guardian/CMC before 25.2.0](https://agentprime.io/advisories/CVE-2025-3718.md)
  `CVE-2025-3718` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Path traversal
- [Incorrect authorization for traces request/download in CMC before 25.1.0](https://agentprime.io/advisories/CVE-2025-1501.md)
  `CVE-2025-1501` · CVE record: Nozomi Networks CMC · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Broken access control
- [Privilege escalation in Guardian/CMC before 24.6.0](https://agentprime.io/advisories/CVE-2024-13090.md)
  `CVE-2024-13090` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.3 High · Not analysed yet · Published 10 Jun 2025 · Tags: Privilege escalation
- [Authenticated RCE in update functionality in Guardian/CMC before 24.6.0](https://agentprime.io/advisories/CVE-2024-13089.md)
  `CVE-2024-13089` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Command injection
- [Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0](https://agentprime.io/advisories/CVE-2024-4465.md)
  `CVE-2024-4465` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: Broken access control
- [Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1](https://agentprime.io/advisories/CVE-2023-6916.md)
  `CVE-2023-6916` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2024 · Tags: Information disclosure
- [Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0](https://agentprime.io/advisories/CVE-2023-5253.md)
  `CVE-2023-5253` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 15 Jan 2024 · Tags: Authentication bypass
- [DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0](https://agentprime.io/advisories/CVE-2023-32649.md)
  `CVE-2023-32649` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.2 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-1286
- [SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0](https://agentprime.io/advisories/CVE-2023-29245.md)
  `CVE-2023-29245` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2023 · Tags: SQL injection
- [Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0](https://agentprime.io/advisories/CVE-2023-2567.md)
  `CVE-2023-2567` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.7 High · Not analysed yet · Published 19 Sept 2023 · Tags: SQL injection
- [DoS via SAML configuration in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-23903.md)
  `CVE-2023-23903` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-1286
- [Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-24015.md)
  `CVE-2023-24015` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-1286
- [Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-24471.md)
  `CVE-2023-24471` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.1 High · Not analysed yet · Published 9 Aug 2023 · Tags: Broken access control
- [Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-22843.md)
  `CVE-2023-22843` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Aug 2023 · Tags: Cross-site scripting (XSS)
- [Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-23574.md)
  `CVE-2023-23574` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Aug 2023 · Tags: SQL injection
- [Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-22378.md)
  `CVE-2023-22378` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Aug 2023 · Tags: SQL injection
- [Session Fixation in Guardian/CMC before 22.6.2](https://agentprime.io/advisories/CVE-2023-24477.md)
  `CVE-2023-24477` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 9 Aug 2023 · Tags: Authentication bypass
- [Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2](https://agentprime.io/advisories/CVE-2022-4259.md)
  `CVE-2022-4259` · CVE record: Nozomi Networks CMC and 1 more · CVSS 8.7 High · Not analysed yet · Published 4 May 2023 · Tags: SQL injection
- [Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0](https://agentprime.io/advisories/CVE-2022-0551.md)
  `CVE-2022-0551` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2022 · Tags: CWE-20
- [Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0](https://agentprime.io/advisories/CVE-2022-0550.md)
  `CVE-2022-0550` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2022 · Tags: CWE-20
- [Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4](https://agentprime.io/advisories/CVE-2021-26724.md)
  `CVE-2021-26724` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.6 High · Not analysed yet · Published 22 Feb 2021 · Tags: Command injection
- [Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4](https://agentprime.io/advisories/CVE-2021-26725.md)
  `CVE-2021-26725` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 8.6 High · Not analysed yet · Published 22 Feb 2021 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nozomi-networks-cmc>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nozomi-networks-cmc/>. Everything for agents: <https://agentprime.io/llms.txt>.