Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

29 results

Jul 30, 2026SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability.CVE-2026-28323 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com documentation.solarwinds.com
Jun 2, 2026SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due tCVE-2026-28299 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.2
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific acCVE-2025-40554 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would alCVE-2025-40553 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actioCVE-2025-40552 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2025-40551 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.8
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Product
Web Help Desk
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 6, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administratiCVE-2025-40537 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Jan 28, 2026SolarWinds Web Help Desk Security Control Bypass VulnerabilityCVE-2025-40536 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 8.1
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
Product
Web Help Desk
On CISA’s list since
Feb 12, 2026 (federal fix deadline Feb 15, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Sep 23, 2025SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2025-26399 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedRansomwareCritical 9.8
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
Product
Web Help Desk
On CISA’s list since
Mar 9, 2026 (federal fix deadline Mar 12, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Sep 1, 2025SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker tCVE-2024-28988 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk customers apply the patch, which is now available. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Jul 29, 2025SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure.CVE-2025-26400 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Feb 11, 2025SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.CVE-2024-28989 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.5
SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Dec 10, 2024SolarWinds Web Help Desk was susceptible to a local file read vulnerability.CVE-2024-45709 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Aug 21, 2024SolarWinds Web Help Desk Hardcoded Credential VulnerabilityCVE-2024-28987 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.1
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
Product
Web Help Desk
On CISA’s list since
Oct 15, 2024 (federal fix deadline Nov 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Aug 13, 2024SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2024-28986 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.8
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
Product
Web Help Desk
On CISA’s list since
Aug 15, 2024 (federal fix deadline Sep 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Mar 10, 2022Sensitive information could be displayed when a detailed technical error message is posted.CVE-2021-35251 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web Help Desk installation.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Dec 27, 2021Hard coded credentials discovered in SolarWinds Web Help Desk product.CVE-2021-35232 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.8
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Dec 23, 2021The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests.CVE-2021-35243 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Aug 26, 2021Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2.CVE-2021-32076 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record solarwinds.com exchange.xforce.ibmcloud.com
Jan 15, 2021SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.CVE-2019-16961 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Jan 6, 2021SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.CVE-2019-16954 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Jan 4, 2021SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.CVE-2019-16960 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Jan 4, 2021SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.CVE-2019-16956 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Dec 21, 2020SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.CVE-2019-16959 · Other software · Solarwinds · reported by MITREMedium 6.5
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
Product
Webhelpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.CVE-2019-16957 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
Product
Webhelpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.CVE-2019-16955 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
Product
Webhelpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com esecforte.com
Dec 1, 2020Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.CVE-2019-16958 · Other software · Solarwinds · reported by MITREMedium 5.4
Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.
Product
Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esecforte.com solarwinds.com
Apr 7, 2009Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML vCVE-2009-1261 · Other software · Webhelpdesk · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML via the (1) Report Name, (2) Asset No., and (3) Full Name fields in a Models action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Jan 27, 2009Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "eCVE-2009-0303 · Other software · Webhelpdesk · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via vectors related to "encoded JavaScript" and Helpdesk.woa.
Product
Web Help Desk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com updates.webhelpdesk.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.