CVE-2026-28329

MediumCVSS 6.4/10Last modified Oct 20, 2026

Description

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-28339.1An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a P CVE-2026-283304.6SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated CVE-2026-283314.4SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.CVE-2026-283386.1PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule vio CVE-2026-28347.2The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘de CVE-2026-283427.5OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows un CVE-2026-283436.1CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross CVE-2026-283486.1lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javasc CVE-2026-28359.1An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue CVE-2026-283506.1lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes CVE-2026-283515.3pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF whi CVE-2026-283526.5Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11