CVE-2021-27277

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

CVE-2021-31475

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF...

The vulnerability of the SolarWinds Observability Self-Hosted (SWOSH) software for network monitoring and IT infrastructure management lies in the lack of security measures to protect the SQL query structure. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the SolarWinds Observability Self-Hosted SWOSH software for network monitoring and IT infrastructure management is related to the lack of security measures for SQL query structures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

CVE-2019-16961

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...

CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16958

Cross-site Scripting XSS vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name...

CVE-2019-16955

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...

CVE-2019-16959

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

CVE-2019-16960

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

CVE-2019-12769

SolarWinds Serv-U Managed File Transfer MFT Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters...

CVE-2019-12864

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us=false query parameter...

CVE-2019-12954

SolarWinds Network Performance Monitor Orion Platform 2018, NPM 12.3, NetPath 1.1.3 allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT...

The vulnerability of the SolarWinds Serv-U File Server file server, related to deficiencies in access control, allows a hacker to execute arbitrary code.

The vulnerability of the SolarWinds Serv-U File Server file server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the SolarWinds Serv-U File Server file server lies in the incorrect path name limitation for the directory, allowing a hacker to execute arbitrary code.

The vulnerability of the SolarWinds Serv-U File Server file server is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the SolarWinds Serv-U File Server file server arises from improper encoding or decoding of output data, allowing a perpetrator to execute arbitrary code.

The vulnerability of the SolarWinds Serv-U File Server file server is related to incorrect encoding or encapsulation of output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

US Border Patrol Is Spying on Millions of American Drivers

Plus: The SEC lets SolarWinds off the hook, Microsoft stops a historic DDoS attack, and FBI documents reveal the agency spied on an immigration activist Signal group in New York City...

Exploit for CVE-2025-40547

CVE-2025-40547 - Serv-U Administrative Pre-Authenticated Remot...

SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny

The U.S. Securities and Exchange Commission SEC has abandoned its lawsuit against SolarWinds and its chief information security officer, alleging that the company had misled investors about the security practices that led to the 2020 supply chain attack. In a joint motion filed November 20, 2025,...

CVE-2025-40545

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required...

CVE-2025-26391

SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account...