CVE-2026-33922 | Medium | 6.0 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input param… |
CVE-2026-33921 | Medium | 5.2 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of t… |
CVE-2026-33390 | High | 8.1 | 2026-07-09 | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authentica… |
CVE-2026-31985 | High | 8.1 | 2026-07-09 | When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and n… |
CVE-2026-31984 | High | 7.5 | 2026-07-09 | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on inp… |
CVE-2026-31983 | Medium | 5.3 | 2026-07-09 | A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys… |
CVE-2026-31982 | High | 7.1 | 2026-07-09 | An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection paramete… |
CVE-2026-31981 | Medium | 5.9 | 2026-07-09 | A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restricti… |
CVE-2025-40904 | Medium | 6.5 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40903 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authent… |
CVE-2025-40902 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with ad… |
CVE-2025-40901 | Medium | 5.9 | 2026-05-19 | A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticate… |
CVE-2025-40900 | Medium | 4.6 | 2026-05-19 | An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40899 | High | 8.9 | 2026-04-15 | A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authentic… |
CVE-2025-40897 | High | 8.1 | 2026-04-15 | An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for us… |
CVE-2025-40896 | Medium | 6.5 | 2026-03-04 | The server certificate was not verified when an Arc agent connected to a Guardian or CMC.
A malicious actor could perform a man-in-the-middle attack and int… |
CVE-2025-40895 | Medium | 4.8 | 2026-03-04 | A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties.
A… |
CVE-2025-40894 | Medium | 4.4 | 2026-03-04 | A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter.
A malici… |
CVE-2025-40898 | High | 8.1 | 2025-12-18 | A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated u… |
CVE-2025-40893 | Medium | 6.1 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated att… |
CVE-2025-40892 | High | 8.9 | 2025-12-18 | A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40891 | Medium | 4.7 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An una… |
CVE-2025-40890 | High | 7.9 | 2025-11-25 | A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.
An authenticate… |
CVE-2025-40889 | High | 8.1 | 2025-10-07 | A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with l… |
CVE-2025-40888 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited priv… |
CVE-2025-40887 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40886 | High | 7.5 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40885 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with li… |
CVE-2025-3719 | High | 8.1 | 2025-10-07 | An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited… |
CVE-2025-3718 | High | 7.9 | 2025-10-07 | A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authent… |
CVE-2025-1501 | Medium | 4.3 | 2025-08-26 | An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restrictio… |
CVE-2024-13090 | High | 7.0 | 2025-06-10 | A privilege escalation vulnerability may enable a service account to elevate its privileges.
The sudo rules configured for a local service account were exce… |
CVE-2024-13089 | High | 7.2 | 2025-06-10 | An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands.
… |
CVE-2024-4465 | Medium | 6.0 | 2024-09-11 | An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited p… |
CVE-2023-5938 | High | 8.0 | 2024-05-15 | Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attack… |
CVE-2023-5937 | Low | 3.8 | 2024-05-15 | On Windows systems, the Arc configuration files resulted to be world-readable.
This can lead to information disclosure by local attackers, via exfiltration… |
CVE-2023-5936 | High | 7.8 | 2024-05-15 | On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges.
By tampering with such file, a malicious local user in the system may be a… |
CVE-2023-5935 | High | 7.4 | 2024-05-15 | When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authenticatio… |
CVE-2024-0218 | High | 7.5 | 2024-04-10 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functiona… |
CVE-2023-6916 | High | 7.2 | 2024-04-10 | Audit records for OpenAPI requests may include sensitive information.
This could lead to unauthorized accesses and privilege escalation. |
CVE-2023-5253 | Medium | 5.3 | 2024-01-15 | A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthentica… |
CVE-2023-32649 | High | 7.5 | 2023-09-19 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence… |
CVE-2023-2567 | High | 8.8 | 2023-09-19 | A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query func… |
CVE-2023-29245 | High | 8.1 | 2023-09-19 | A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functional… |
CVE-2023-24015 | Medium | 4.3 | 2023-08-09 | A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name… |
CVE-2023-23903 | Medium | 4.9 | 2023-08-09 | An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every sub… |
CVE-2023-24471 | Medium | 6.5 | 2023-08-09 | An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.
An a… |
CVE-2023-23574 | High | 8.8 | 2023-08-09 | A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticate… |
CVE-2023-22843 | Medium | 6.4 | 2023-08-09 | An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Int… |
CVE-2023-22378 | High | 8.8 | 2023-08-09 | A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated att… |
CVE-2023-24477 | High | 7.0 | 2023-08-09 | In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the… |
CVE-2022-4259 | High | 8.8 | 2023-05-04 | Due to improper input validation in the Alerts controller, a SQL injection vulnerability in Nozomi Networks Guardian and CMC allows an authenticated attacker t… |
CVE-2022-0551 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manage… |
CVE-2022-0550 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report… |
CVE-2021-26725 | High | 7.2 | 2021-02-22 | Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected syst… |
CVE-2021-26724 | High | 7.2 | 2021-02-22 | OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrator… |