Skip to content
Noroxi

SolarWinds records

335 published records for vendor solarwinds.

Researcher profile

Entered KEV
11 · 3.3%
Weaponized
22 · 6.6%
Pre-auth RCE
44
With a fix record
2.7%
Median publish → KEV
41 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

335 records
  • CVE-2020-10148
    97Now

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    solarwinds · orion platformDec 29, 2020

  • CVE-2021-35211
    97Now

    Serv-U Remote Memory Escape Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 91%

    solarwinds · serv-uJul 14, 2021

  • CVE-2025-26399
    96Now

    SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    solarwinds · web help deskSep 23, 2025

  • CVE-2024-28987
    94Now

    SolarWinds Web Help Desk Hardcoded Credential Vulnerability

    CriticalCVSS 9.1KEVWeaponizedEPSS 93%

    solarwinds · web help deskAug 21, 2024

  • CVE-2024-28986
    94Now

    SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    solarwinds · web help deskAug 13, 2024

  • CVE-2025-40551
    94Now

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    solarwinds · web help deskJan 28, 2026

  • CVE-2025-40536
    91Now

    SolarWinds Web Help Desk Security Control Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 73%

    solarwinds · web help deskJan 28, 2026

  • CVE-2024-28995
    90Now

    SolarWinds Serv-U L Directory Transversal Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    solarwinds · serv-uJun 6, 2024

  • CVE-2026-28318
    73This week

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 43%

    solarwinds · serv-uJun 4, 2026

  • CVE-2015-5371
    68This week

    The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified

    CriticalCVSS 10.0WeaponizedEPSS 93%

    solarwinds · storage managerJul 6, 2015

  • CVE-2021-31474
    67This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 202

    CriticalCVSS 9.8No exploitEPSS 93%

    solarwinds · network performance monitorMay 21, 2021

  • CVE-2004-0330
    66This week

    Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to th

    CriticalCVSS 10.0WeaponizedEPSS 85%

    solarwinds · serv-u file serverNov 23, 2004

  • CVE-2009-4006
    65This week

    Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0

    CriticalCVSS 10.0WeaponizedEPSS 82%

    solarwinds · serv-u file serverNov 20, 2009

  • CVE-2024-0692
    63This week

    SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 92%

    solarwinds · security event managerMar 1, 2024

  • CVE-2015-2284
    62This week

    userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbi

    CriticalCVSS 10.0WeaponizedEPSS 72%

    solarwinds · firewall security managerMar 24, 2015

  • CVE-2016-3643
    62This week

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demons

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    solarwinds · virtualization managerJun 17, 2016

  • CVE-2004-2111
    60This week

    Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via

    HighCVSS 8.5WeaponizedEPSS 86%

    solarwinds · serv-u file serverDec 31, 2004

  • CVE-2016-4350
    60This week

    Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storag

    CriticalCVSS 9.8No exploitEPSS 70%

    solarwinds · storage resource monitorMay 9, 2016

  • CVE-2012-2576
    60This week

    SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, a

    CriticalCVSS 9.8WeaponizedEPSS 60%

    solarwinds · backup profilerDec 20, 2017

  • CVE-2017-7722
    60This week

    In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and

    CriticalCVSS 10.0WeaponizedEPSS 12%

    solarwinds · log \& event managerApr 12, 2017

  • CVE-2021-35247
    60This week

    Improper Input Validation Vulnerability in Serv-U

    MediumCVSS 5.3KEVWeaponizedEPSS 3%

    solarwinds · serv-uJan 10, 2022

  • CVE-2022-36958
    59Plan

    SolarWinds Platform Deserialization of Untrusted Data

    HighCVSS 8.8No exploitEPSS 81%

    solarwinds · orion platformOct 20, 2022

  • CVE-2021-35216
    59Plan

    Deserialization of Untrusted Data in Resource Controls Remote Code Execution

    HighCVSS 8.8No exploitEPSS 81%

    solarwinds · patch managerSep 1, 2021

  • CVE-2025-40553
    59Plan

    SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    solarwinds · web help deskJan 28, 2026

  • CVE-2021-35218
    58Plan

    Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    solarwinds · orion platformSep 1, 2021