Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

95 results · page 1 of 2

Jul 21, 2026SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privilCVE-2026-28321 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation.CVE-2026-28317 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with tCVE-2026-28316 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from anCVE-2026-28315 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.2
SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover.CVE-2026-28314 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.CVE-2026-28313 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com https
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability.CVE-2026-28312 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com https
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system adminisCVE-2026-28310 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com https
Jul 21, 2026SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts.CVE-2026-28309 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com https
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution.CVE-2026-28308 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group.CVE-2026-28307 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.CVE-2026-28306 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root.CVE-2026-28305 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root.CVE-2026-28304 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jul 21, 2026SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as rooCVE-2026-28302 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jun 4, 2026SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilityCVE-2026-28318 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 7.5
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Product
Serv-U
On CISA’s list since
Jun 5, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Apr 4, 2026FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized buffer data into the sCVE-2018-25252 · Other software · Serv-U · reported by VulnCheckMedium 6.9
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized buffer data into the site profile IP field. Attackers can create a malicious site profile containing 500 bytes of repeated characters and paste it into the IP field to trigger a buffer overflow that crashes the FTP Voyager process.
Product
FTP Voyager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com serv-u.com
Feb 24, 2026An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as aCVE-2025-40541 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Feb 24, 2026A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accountCVE-2025-40540 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Feb 24, 2026A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accountCVE-2025-40539 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Feb 24, 2026A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitCVE-2025-40538 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Nov 18, 2025A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute cCVE-2025-40549 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Nov 18, 2025A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code.CVE-2025-40548 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Nov 18, 2025A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code.CVE-2025-40547 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.1
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Apr 15, 2025SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability.CVE-2024-45712 · Other software · SolarWinds · reported by psirt@solarwinds.comLow 2.6
SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account, on the local machine, from the local browser session. Therefore the risk is very low.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Oct 16, 2024Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.CVE-2024-45714 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.8
Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com
Oct 16, 2024SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticaCVE-2024-45711 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com
Jun 6, 2024SolarWinds Serv-U Path Traversal Vulnerability CVE-2024-28995 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 8.6
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
Product
Serv-U
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog solarwinds.com solarwinds.com
May 3, 2024A highly privileged account can overwrite arbitrary files on the system with log output.CVE-2024-28072 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.7
A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwindscore.my.site.com solarwinds.com
Apr 17, 2024SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability.CVE-2024-28073 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.4
SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be exploited.
Product
ServU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com solarwinds.com
Dec 5, 2023A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which CVE-2023-40053 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5
A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Sep 7, 2023A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication.CVE-2023-40060 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Aug 10, 2023 A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication.CVE-2023-35179 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.2
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Jun 15, 2023SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request.CVE-2023-23841 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request.  Part of the URL of the request discloses sensitive data.
Product
ServU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Dec 16, 2022This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1.CVE-2022-38106 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.4
This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.
Product
Serv-U File Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.mitre.org documentation.solarwinds.com
Dec 16, 2022Common encryption key appears to be used across all deployed instances of Serv-U FTP Server.CVE-2021-35252 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.
Product
Serv-U FTP Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.mitre.org documentation.solarwinds.com
May 17, 2022This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should notCVE-2021-35249 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.3
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Apr 25, 2022A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3.CVE-2021-35250 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Jan 10, 2022SolarWinds Serv-U Improper Input Validation VulnerabilityCVE-2021-35247 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedMedium 4.3
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
Product
Serv-U
On CISA’s list since
Jan 21, 2022 (federal fix deadline Feb 4, 2022)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Dec 6, 2021When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.CVE-2021-35245 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.4
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine.
Product
Serv-U FTP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Dec 6, 2021Serv-U server responds with valid CSRFToken when the request contains only Session.CVE-2021-35242 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.3
Serv-U server responds with valid CSRFToken when the request contains only Session.
Product
Serv-U Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Aug 31, 2021The Serv-U File Server allows for events such as user login failures to be audited by executing a command.CVE-2021-35223 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.5
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com support.solarwinds.com
Jul 14, 2021SolarWinds Serv-U Remote Code Execution VulnerabilityCVE-2021-35211 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedRansomwareCritical 9
SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
Product
Serv-U
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SolarWinds’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog microsoft.com solarwinds.com
May 11, 2021Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."CVE-2021-32604 · Other software · Solarwinds · reported by MITREMedium 5.4
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."
Product
Serv-u
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com trustwave.com
May 4, 2021SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.CVE-2021-25179 · Other software · Solarwinds · reported by MITREMedium 6.1
SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.
Product
Serv-u File Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com github.com
May 4, 2021SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.CVE-2020-22428 · Other software · Solarwinds · reported by MITREMedium 4.8
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload.
Product
Serv-u FTP Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.solarwinds.com
May 4, 2021An issue was discovered in SolarWinds Serv-U before 15.2.2.CVE-2021-3154 · Other software · Solarwinds · reported by MITREHigh 7.5
An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481.
Product
Serv-u
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Feb 3, 2021In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable andCVE-2021-25276 · Other software · Solarwinds · reported by MITREHigh 7.1
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges.
Product
Serv-u
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trustwave.com trustwave.com
Feb 3, 2021SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.CVE-2020-35482 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
Product
Serv-u
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Feb 3, 2021SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.CVE-2020-35481 · Other software · Solarwinds · reported by MITRECritical 9.8
SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
Product
Serv-u
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.