Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

33 results

Sep 17, 2026SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability.CVE-2026-28326 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Sep 12, 2024SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability.CVE-2024-28991 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Sep 12, 2024SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability.CVE-2024-28990 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.3
SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability.CVE-2024-28993 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.6
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability.CVE-2024-28992 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.6
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager.CVE-2024-28074 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability.CVE-2024-23475 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability.CVE-2024-23474 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.6
The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability.CVE-2024-23472 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability.CVE-2024-23471 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability.CVE-2024-23470 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to run commands and executables.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability.CVE-2024-23469 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to perform the actions with SYSTEM privileges.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability.CVE-2024-23468 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.6
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability.CVE-2024-23467 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability.CVE-2024-23466 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to perform the actions with SYSTEM privileges.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jul 17, 2024The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability.CVE-2024-23465 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.3
The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
May 14, 2024The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.CVE-2024-28075 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
May 14, 2024The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability.CVE-2024-23473 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.6
The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Feb 15, 2024SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability.CVE-2024-23479 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Feb 15, 2024SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability.CVE-2024-23478 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Feb 15, 2024The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability.CVE-2024-23477 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.9
The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Feb 15, 2024The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability.CVE-2024-23476 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.6
The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Feb 15, 2024The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability.CVE-2023-40057 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9
The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Dec 21, 2023Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat CVE-2023-40058 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.5
Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat actor is in the same environment.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability.CVE-2023-35187 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com https
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.CVE-2023-35186 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.CVE-2023-35185 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.8
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.CVE-2023-35184 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability.CVE-2023-35183 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.8
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.CVE-2023-35182 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability.CVE-2023-35181 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.8
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Oct 19, 2023The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.CVE-2023-35180 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 21, 2021The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-35227 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.7
The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.
Product
Access Rights Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.