CVE-2026-28325

HIGH8.8

Published 2026-09-22 · Updated 2026-09-23 · Source psirt@solarwinds.com

Description

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-97185
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.
2026-09-24 · score 7.8
CVE-2026-85682
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
2026-09-24 · score 8.8
CVE-2026-78311
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
2026-09-24 · score 8.8
CVE-2026-78309
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
2026-09-24 · score 8.8
CVE-2026-77193
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
2026-09-24 · score 7.5