Nozomi Networks PSIRT
organization01
references
Other names and identifiers for this entity.
nozomi_psirtUS prodsec@nozominetworks.com
02
assessed vulnerabilities (61)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-33920US | — | — | ||
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a v… | ||||
| CVE-2026-33391US | —OT elevated | — | ||
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limite… | ||||
| CVE-2026-33389US | — | — | ||
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without valid… | ||||
| CVE-2026-33388US | —OT elevated | — | ||
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited… | ||||
| CVE-2026-33387US | — | — | ||
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileg… | ||||
| CVE-2026-33922US | — | — | ||
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user wi… | ||||
| CVE-2026-33921US | —OT elevated | — | ||
The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of be… | ||||
| CVE-2026-33390US | — | — | ||
An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited… | ||||
| CVE-2026-31985US | — | — | ||
When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided… | ||||
| CVE-2026-31984US | — | — | ||
A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audi… | ||||
| CVE-2026-31983US | —OT elevated | — | ||
A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpo… | ||||
| CVE-2026-31982US | — | — | ||
An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated… | ||||
| CVE-2026-31981US | medium4.8 | — | ||
A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated… | ||||
| CVE-2025-40904US | medium5.4 | — | ||
A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privile… | ||||
| CVE-2025-40903US | medium4.8 | — | ||
A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with admi… | ||||
| CVE-2025-40902US | medium4.8 | — | ||
A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileg… | ||||
| CVE-2025-40901US | medium4.8 | — | ||
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administr… | ||||
| CVE-2025-40900US | — | — | ||
An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileg… | ||||
| CVE-2025-40899US | — | — | ||
A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom… | ||||
| CVE-2025-40897US | —OT elevated | — | ||
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only pr… | ||||