CVE-2025-26395

CVE-2025-26395 concerns SolarWinds Observability Self-Hosted, where an XSS vulnerability arises from an unsanitized URL field. The attack requires an administrator-level account and user interaction. Affected component details (version ranges, specific modules) and exact root cause are not explic...

CVE-2025-26394

CVE-2025-26394 affects SolarWinds Observability Self-Hosted and is an open redirection vulnerability caused by insufficient URL sanitization. The core issue is improper URL cleanup that could redirect users to a malicious site. The CVE entry lists CVSS v3.1 base score 4.8 (Medium) with adjacent a...

CVE-2025-26397

SolarWinds Observability Self-Hosted is affected by a Deserialization of Untrusted Data Local Privilege Escalation. A low-privilege attacker with local access and authentication can escalate to run code in a permission-protected folder. Connected sources provide concrete details: (1) root cause i...

CVE-2025-26392

SolarWinds Observability Self-Hosted is affected by CVE-2025-26392: an SQL injection vulnerability that can disclose sensitive data when authenticated from a low-privilege account. The issue affects the product as described in multiple sources (NVD, Red Hat/CIRCL/CVE lists and related advisories)...

CVE-2026-28297

CVE-2026-28297 affects SolarWinds Observability Self-Hosted. A stored cross-site scripting vulnerability could lead to unintended script execution. CVSS metrics show a HIGH base score (8.7 from NVD; 6.1 from PSIRT). Exploitation details or fixed versions are not provided in the connected document...

CVE-2025-26391

CVE-2025-26391: SolarWinds Observability Self-Hosted exposes a cross-site scripting (XSS) vulnerability in user-created URL fields of the SolarWinds Platform. The issue requires authentication from a low-privilege account. Public exploitation details or concrete remediation are not provided in th...

CVE-2026-28298

CVE-2026-28298 affects SolarWinds Observability Self-Hosted. The Red Hat, NVD, CIRCL, EUVD/ENISA, CVE/CVE-Org and other feeds describe a stored cross-site scripting vulnerability that can lead to unintended script execution. The vulnerability is described as storage-based XSS with the potential f...

CVE-2025-40545

Affected product: SolarWinds Observability Self-Hosted. Vulnerability: Open redirection due to improper URL sanitization in the application. Root cause / nature: URL handling allows manipulation of the redirect target. Impact (as stated): Potential to redirect users to a malicious site (confident...