# cve.now: Splunk

The newest entries naming Splunk as an affected vendor (up to 200), of 347 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-76531](https://cve.now/CVE-2026-76531.md): Files or Directories Accessible to External Parties in Splunk SOAR (CVSS 9.9)
- [CVE-2026-76530](https://cve.now/CVE-2026-76530.md): Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR (CVSS 8.8)
- [CVE-2026-76529](https://cve.now/CVE-2026-76529.md): Improper Protection of Alternate Path in Splunk SOAR (CVSS 9.8)
- [CVE-2026-76528](https://cve.now/CVE-2026-76528.md): Protection Mechanism Failure in Splunk SOAR (CVSS 9.8)
- [CVE-2026-76527](https://cve.now/CVE-2026-76527.md): Improper Check or Handling of Exceptional Conditions in Splunk SOAR (CVSS 9.8)
- [CVE-2026-76526](https://cve.now/CVE-2026-76526.md): Improper Neutralization in Splunk SOAR (CVSS 8.8)
- [CVE-2026-76408](https://cve.now/CVE-2026-76408.md): Improper Control of a Resource Through its Lifetime in Splunk SOAR (CVSS 9.8)
- [CVE-2026-76407](https://cve.now/CVE-2026-76407.md): Improper Access Control in Splunk SOAR (CVSS 9.8)
- [CVE-2026-76406](https://cve.now/CVE-2026-76406.md): Information Disclosure through REST API Authentication in Splunk SOAR (CVSS 5.9)
- [CVE-2026-76308](https://cve.now/CVE-2026-76308.md): Missing Authorization through the REST API in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76307](https://cve.now/CVE-2026-76307.md): Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR (CVSS 7.2)
- [CVE-2026-76306](https://cve.now/CVE-2026-76306.md): Information Disclosure through REST API Query Filters in Splunk SOAR (CVSS 7.5)
- [CVE-2026-76305](https://cve.now/CVE-2026-76305.md): Improper Access Control during App Downloads in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76304](https://cve.now/CVE-2026-76304.md): Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR (CVSS 4.3)
- [CVE-2026-76303](https://cve.now/CVE-2026-76303.md): Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR (CVSS 5.7)
- [CVE-2026-76302](https://cve.now/CVE-2026-76302.md): Security Hardening in Splunk Enterprise - October 2026 (CVSS 9.9)
- [CVE-2026-76301](https://cve.now/CVE-2026-76301.md): Security Hardening in Splunk Enterprise - October 2026 (CVSS 9.8)
- [CVE-2026-76300](https://cve.now/CVE-2026-76300.md): Security Hardening in Splunk Enterprise - October 2026 (CVSS 8.8)
- [CVE-2026-76299](https://cve.now/CVE-2026-76299.md): Security Hardening in Splunk Enterprise - October 2026 (CVSS 9.9)
- [CVE-2026-76298](https://cve.now/CVE-2026-76298.md): Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76297](https://cve.now/CVE-2026-76297.md): Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise (CVSS 4.2)
- [CVE-2026-76296](https://cve.now/CVE-2026-76296.md): Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76295](https://cve.now/CVE-2026-76295.md): SPL Injection through the REST API in Splunk Secure Gateway (CVSS 4.3)
- [CVE-2026-76294](https://cve.now/CVE-2026-76294.md): Improper Access Control in Field Extraction Management in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76293](https://cve.now/CVE-2026-76293.md): Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise (CVSS 7.2)
- [CVE-2026-76292](https://cve.now/CVE-2026-76292.md): Missing Authorization through REST API Endpoints in Splunk Secure Gateway (CVSS 6.5)
- [CVE-2026-76291](https://cve.now/CVE-2026-76291.md): Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76290](https://cve.now/CVE-2026-76290.md): Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-76289](https://cve.now/CVE-2026-76289.md): Denial of Service (DoS) through the REST API in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76288](https://cve.now/CVE-2026-76288.md): Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-76287](https://cve.now/CVE-2026-76287.md): Authorization Bypass in the Data Management REST API in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76286](https://cve.now/CVE-2026-76286.md): Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server (CVSS 5.3)
- [CVE-2026-76285](https://cve.now/CVE-2026-76285.md): Improper Adherence to Coding Standards in Splunk Enterprise (CVSS 9.8)
- [CVE-2026-76284](https://cve.now/CVE-2026-76284.md): Improper Neutralization in Splunk Enterprise (CVSS 9.8)
- [CVE-2026-76283](https://cve.now/CVE-2026-76283.md): Protection Mechanism Failure in Splunk Enterprise (CVSS 7.6)
- [CVE-2026-76282](https://cve.now/CVE-2026-76282.md): Improper Control of a Resource Through its Lifetime in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76281](https://cve.now/CVE-2026-76281.md): Improper Access Control in Splunk Enterprise (CVSS 5.3)
- [CVE-2026-76280](https://cve.now/CVE-2026-76280.md): Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway (CVSS 6.3)
- [CVE-2026-76279](https://cve.now/CVE-2026-76279.md): Improper Input Validation of Index Names through the collect Command in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76278](https://cve.now/CVE-2026-76278.md): Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76277](https://cve.now/CVE-2026-76277.md): Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise (CVSS 4.1)
- [CVE-2026-76276](https://cve.now/CVE-2026-76276.md): Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76275](https://cve.now/CVE-2026-76275.md): Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76274](https://cve.now/CVE-2026-76274.md): Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud (CVSS 6.5)
- [CVE-2026-76273](https://cve.now/CVE-2026-76273.md): Improper Input Validation through the collect Command in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76272](https://cve.now/CVE-2026-76272.md): Missing Access Control through the REST API in Splunk Secure Gateway (CVSS 4.3)
- [CVE-2026-76271](https://cve.now/CVE-2026-76271.md): Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76270](https://cve.now/CVE-2026-76270.md): Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76269](https://cve.now/CVE-2026-76269.md): Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76268](https://cve.now/CVE-2026-76268.md): Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise (CVSS 9.8)
- [CVE-2026-76267](https://cve.now/CVE-2026-76267.md): Log Injection through the REST API in Splunk App for Splunk O11y Cloud (CVSS 4.3)
- [CVE-2026-76266](https://cve.now/CVE-2026-76266.md): Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise (CVSS 7.7)
- [CVE-2026-76265](https://cve.now/CVE-2026-76265.md): Improper Access Control through REST API Endpoints in Splunk Secure Gateway (CVSS 6.5)
- [CVE-2026-76264](https://cve.now/CVE-2026-76264.md): Improper Authorization through the REST API in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76405](https://cve.now/CVE-2026-76405.md): Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app (CVSS 4.3)
- [CVE-2026-76404](https://cve.now/CVE-2026-76404.md): Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app (CVSS 9.1)
- [CVE-2026-76403](https://cve.now/CVE-2026-76403.md): Improper Certificate Validation through HTTP Event Collector Kerberos Authentication in Splunk Connect for Kafka (CVSS 7.4)
- [CVE-2026-76402](https://cve.now/CVE-2026-76402.md): Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka (CVSS 8.2)
- [CVE-2026-76401](https://cve.now/CVE-2026-76401.md): Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka (CVSS 5.9)
- [CVE-2026-76400](https://cve.now/CVE-2026-76400.md): Denial of Service (DoS) through the REST API in Splunk Connect for Kafka (CVSS 5.9)
- [CVE-2026-76399](https://cve.now/CVE-2026-76399.md): Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit (CVSS 8.1)
- [CVE-2026-76398](https://cve.now/CVE-2026-76398.md): Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit (CVSS 4.3)
- [CVE-2026-76397](https://cve.now/CVE-2026-76397.md): Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit (CVSS 8.1)
- [CVE-2026-76396](https://cve.now/CVE-2026-76396.md): Improper Access Control through Scheduled Searches in Splunk AI Toolkit (CVSS 7.5)
- [CVE-2026-76395](https://cve.now/CVE-2026-76395.md): Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit (CVSS 8.8)
- [CVE-2026-76394](https://cve.now/CVE-2026-76394.md): Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit (CVSS 8.3)
- [CVE-2026-76393](https://cve.now/CVE-2026-76393.md): Race Condition during Model Upload through the REST API in Splunk AI Toolkit (CVSS 5.9)
- [CVE-2026-76392](https://cve.now/CVE-2026-76392.md): Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit (CVSS 5.4)
- [CVE-2026-76391](https://cve.now/CVE-2026-76391.md): Improper Privilege Management through Agent Run History in Splunk AI Toolkit (CVSS 8.3)
- [CVE-2026-76390](https://cve.now/CVE-2026-76390.md): Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud (CVSS 5.3)
- [CVE-2026-76389](https://cve.now/CVE-2026-76389.md): Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud (CVSS 8.8)
- [CVE-2026-76388](https://cve.now/CVE-2026-76388.md): Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security (CVSS 8.1)
- [CVE-2026-76387](https://cve.now/CVE-2026-76387.md): SPL Injection through the REST API in Splunk Enterprise Security (CVSS 8.1)
- [CVE-2026-76386](https://cve.now/CVE-2026-76386.md): Information Disclosure through Action Parameters in Zoom app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76385](https://cve.now/CVE-2026-76385.md): Information Disclosure through Action Parameters in Venafi app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76384](https://cve.now/CVE-2026-76384.md): Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76383](https://cve.now/CVE-2026-76383.md): Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76382](https://cve.now/CVE-2026-76382.md): Information Disclosure through Action Parameters in Phantom app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76381](https://cve.now/CVE-2026-76381.md): Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76380](https://cve.now/CVE-2026-76380.md): Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76379](https://cve.now/CVE-2026-76379.md): Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76378](https://cve.now/CVE-2026-76378.md): Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76377](https://cve.now/CVE-2026-76377.md): Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76376](https://cve.now/CVE-2026-76376.md): Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76375](https://cve.now/CVE-2026-76375.md): Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOAR (CVSS 5.0)
- [CVE-2026-76374](https://cve.now/CVE-2026-76374.md): Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR (CVSS 4.3)
- [CVE-2026-76373](https://cve.now/CVE-2026-76373.md): Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR (CVSS 5.4)
- [CVE-2026-76372](https://cve.now/CVE-2026-76372.md): Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR (CVSS 6.6)
- [CVE-2026-76371](https://cve.now/CVE-2026-76371.md): Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR (CVSS 2.7)
- [CVE-2026-76370](https://cve.now/CVE-2026-76370.md): Information Disclosure through the REST API in Splunk SOAR (CVSS 4.3)
- [CVE-2026-76369](https://cve.now/CVE-2026-76369.md): Path Traversal through Automation Broker in Splunk SOAR (CVSS 2.7)
- [CVE-2026-76368](https://cve.now/CVE-2026-76368.md): Missing Authorization through Playbooks in Splunk SOAR (CVSS 2.7)
- [CVE-2026-76367](https://cve.now/CVE-2026-76367.md): Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR (CVSS 4.0)
- [CVE-2026-76366](https://cve.now/CVE-2026-76366.md): Information Disclosure through the REST API in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76365](https://cve.now/CVE-2026-76365.md): Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76364](https://cve.now/CVE-2026-76364.md): Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76363](https://cve.now/CVE-2026-76363.md): Structured Query Language Injection through the REST API in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76362](https://cve.now/CVE-2026-76362.md): Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR (CVSS 7.4)
- [CVE-2026-76361](https://cve.now/CVE-2026-76361.md): Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR (CVSS 2.7)
- [CVE-2026-76360](https://cve.now/CVE-2026-76360.md): Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR (CVSS 4.3)
- [CVE-2026-76359](https://cve.now/CVE-2026-76359.md): Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76358](https://cve.now/CVE-2026-76358.md): Path Traversal through App Installation Tar Extraction in Splunk SOAR (CVSS 6.5)
- [CVE-2026-76357](https://cve.now/CVE-2026-76357.md): Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR (CVSS 7.6)
- [CVE-2026-76356](https://cve.now/CVE-2026-76356.md): Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR (CVSS 8.1)
- [CVE-2026-76355](https://cve.now/CVE-2026-76355.md): Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-76354](https://cve.now/CVE-2026-76354.md): Path Traversal through Search Head Clustering in Splunk Enterprise (CVSS 8.1)
- [CVE-2026-76353](https://cve.now/CVE-2026-76353.md): Path Traversal through Knowledge Bundle Replication in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76352](https://cve.now/CVE-2026-76352.md): Improper Authorization through the REST API in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76351](https://cve.now/CVE-2026-76351.md): Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway (CVSS 8.8)
- [CVE-2026-76350](https://cve.now/CVE-2026-76350.md): Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76349](https://cve.now/CVE-2026-76349.md): SPL Injection through Splunk Web Form Tokens in Splunk Enterprise (CVSS 6.4)
- [CVE-2026-76348](https://cve.now/CVE-2026-76348.md): Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise (CVSS 3.8)
- [CVE-2026-76347](https://cve.now/CVE-2026-76347.md): Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway (CVSS 5.4)
- [CVE-2026-76346](https://cve.now/CVE-2026-76346.md): Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76345](https://cve.now/CVE-2026-76345.md): Remote Code Execution (RCE) through the REST API in Splunk Enterprise (CVSS 6.0)
- [CVE-2026-76344](https://cve.now/CVE-2026-76344.md): Path Traversal through the Search Dispatch REST API in Splunk Enterprise (CVSS 7.7)
- [CVE-2026-76343](https://cve.now/CVE-2026-76343.md): Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76342](https://cve.now/CVE-2026-76342.md): Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76341](https://cve.now/CVE-2026-76341.md): Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76340](https://cve.now/CVE-2026-76340.md): Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise (CVSS 5.3)
- [CVE-2026-76339](https://cve.now/CVE-2026-76339.md): SPL Injection through the geostats Command in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76338](https://cve.now/CVE-2026-76338.md): Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise (CVSS 8.1)
- [CVE-2026-76337](https://cve.now/CVE-2026-76337.md): Path Traversal through Splunk Web Static File Serving in Splunk Enterprise (CVSS 5.3)
- [CVE-2026-76336](https://cve.now/CVE-2026-76336.md): Improper Access Control through the REST API in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-76335](https://cve.now/CVE-2026-76335.md): Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76334](https://cve.now/CVE-2026-76334.md): SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise (CVSS 6.4)
- [CVE-2026-76333](https://cve.now/CVE-2026-76333.md): Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-76332](https://cve.now/CVE-2026-76332.md): SPL Injection through Splunk Web in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-76331](https://cve.now/CVE-2026-76331.md): SPL Injection through the REST API in Splunk Enterprise (CVSS 8.1)
- [CVE-2026-76330](https://cve.now/CVE-2026-76330.md): SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-76329](https://cve.now/CVE-2026-76329.md): SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise (CVSS 6.4)
- [CVE-2026-76328](https://cve.now/CVE-2026-76328.md): SPL Injection through Splunk Web in Splunk Enterprise (CVSS 6.7)
- [CVE-2026-76327](https://cve.now/CVE-2026-76327.md): SPL Injection through Splunk Web in Splunk Secure Gateway (CVSS 6.4)
- [CVE-2026-76326](https://cve.now/CVE-2026-76326.md): Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-76325](https://cve.now/CVE-2026-76325.md): Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise (CVSS 7.3)
- [CVE-2026-76324](https://cve.now/CVE-2026-76324.md): Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-76323](https://cve.now/CVE-2026-76323.md): SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise (CVSS 6.4)
- [CVE-2026-76322](https://cve.now/CVE-2026-76322.md): SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise (CVSS 6.7)
- [CVE-2026-76321](https://cve.now/CVE-2026-76321.md): SPL Injection through Nearby Event Searches in Splunk Enterprise (CVSS 7.3)
- [CVE-2026-76320](https://cve.now/CVE-2026-76320.md): SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise (CVSS 5.9)
- [CVE-2026-76319](https://cve.now/CVE-2026-76319.md): Remote Code Execution (RCE) through Federated Search in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76318](https://cve.now/CVE-2026-76318.md): Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-76317](https://cve.now/CVE-2026-76317.md): Path Traversal through the Lookup Configuration REST API in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76316](https://cve.now/CVE-2026-76316.md): Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76315](https://cve.now/CVE-2026-76315.md): Code Injection through Splunk Web Manager Configuration in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76314](https://cve.now/CVE-2026-76314.md): Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76313](https://cve.now/CVE-2026-76313.md): Remote Code Execution (RCE) through the REST API in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76312](https://cve.now/CVE-2026-76312.md): Improper Access Control through Embedded Reports in Splunk Enterprise (CVSS 9.4)
- [CVE-2026-76311](https://cve.now/CVE-2026-76311.md): Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise (CVSS 9.4)
- [CVE-2026-76310](https://cve.now/CVE-2026-76310.md): Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise (CVSS 9.4)
- [CVE-2026-76309](https://cve.now/CVE-2026-76309.md): Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-76263](https://cve.now/CVE-2026-76263.md): Improper Access Control through the REST API in Splunk Enterprise (CVSS 5.4)
- [CVE-2026-76262](https://cve.now/CVE-2026-76262.md): Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-76261](https://cve.now/CVE-2026-76261.md): Insecure Default Access Control List through the REST API in Splunk Secure Gateway (CVSS 5.3)
- [CVE-2026-76260](https://cve.now/CVE-2026-76260.md): Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-76259](https://cve.now/CVE-2026-76259.md): Improper Privilege Management on the Management Port in Splunk Enterprise for Windows (CVSS 8.8)
- [CVE-2026-76258](https://cve.now/CVE-2026-76258.md): Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway (CVSS 6.5)
- [CVE-2026-76257](https://cve.now/CVE-2026-76257.md): Missing Authorization through REST API Endpoints in Splunk Secure Gateway (CVSS 6.5)
- [CVE-2026-76256](https://cve.now/CVE-2026-76256.md): Information Exposure through REST API Endpoints in Splunk Secure Gateway (CVSS 4.3)
- [CVE-2026-76255](https://cve.now/CVE-2026-76255.md): Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise (CVSS 6.4)
- [CVE-2026-76254](https://cve.now/CVE-2026-76254.md): SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-76253](https://cve.now/CVE-2026-76253.md): Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise (CVSS 8.8)
- [CVE-2026-76252](https://cve.now/CVE-2026-76252.md): Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise (CVSS 6.8)
- [CVE-2026-76251](https://cve.now/CVE-2026-76251.md): Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud (CVSS 7.1)
- [CVE-2026-20298](https://cve.now/CVE-2026-20298.md): Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise (CVSS 5.3)
- [CVE-2026-20296](https://cve.now/CVE-2026-20296.md): SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise (CVSS 8.3)
- [CVE-2026-20297](https://cve.now/CVE-2026-20297.md): Path Traversal through 'explicit\_appname' in the App Install REST Endpoint in Splunk Enterprise (CVSS 7.2)
- [CVE-2026-20266](https://cve.now/CVE-2026-20266.md): OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit (CVSS 9.1)
- [CVE-2026-20265](https://cve.now/CVE-2026-20265.md): Insecure Default Domain Allowlist in Splunk AI Toolkit (CVSS 4.3)
- [CVE-2026-20258](https://cve.now/CVE-2026-20258.md): Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-20253](https://cve.now/CVE-2026-20253.md): Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise (CVSS 9.8, KEV)
- [CVE-2026-20260](https://cve.now/CVE-2026-20260.md): Log Injection through HTTP Request Paths in Splunk SOAR (CVSS 4.3)
- [CVE-2026-20252](https://cve.now/CVE-2026-20252.md): Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise (CVSS 7.6)
- [CVE-2026-20257](https://cve.now/CVE-2026-20257.md): Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-20259](https://cve.now/CVE-2026-20259.md): Improper Access Control in Splunk Enterprise (CVSS 5.5)
- [CVE-2026-20255](https://cve.now/CVE-2026-20255.md): Improper Input Validation through Classic Dashboards in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-20251](https://cve.now/CVE-2026-20251.md): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway (CVSS 8.8)
- [CVE-2026-20254](https://cve.now/CVE-2026-20254.md): Information Disclosure through External Content Restriction Bypass in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-20256](https://cve.now/CVE-2026-20256.md): Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise (CVSS 5.7)
- [CVE-2026-20238](https://cve.now/CVE-2026-20238.md): Improper Access Control through Role Inheritance in Splunk AI Toolkit app (CVSS 6.5)
- [CVE-2026-20239](https://cve.now/CVE-2026-20239.md): Sensitive Information Disclosure through Log Files in Splunk Enterprise (CVSS 7.5)
- [CVE-2026-20240](https://cve.now/CVE-2026-20240.md): Denial of Service through coldToFrozen.sh Script in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-20205](https://cve.now/CVE-2026-20205.md): Sensitive Information Disclosure in ''\_internal'' index in Splunk MCP Server app (CVSS 7.2)
- [CVE-2026-20203](https://cve.now/CVE-2026-20203.md): Improper Access Control in Data Model Acceleration in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-20204](https://cve.now/CVE-2026-20204.md): Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise (CVSS 7.1)
- [CVE-2026-20202](https://cve.now/CVE-2026-20202.md): Improper Input Validation during User Account Creation in Splunk Enterprise (CVSS 6.6)
- [CVE-2026-20163](https://cve.now/CVE-2026-20163.md): Remote Command Execution (RCE) through the '/splunkd/\_\_upload/indexing/preview' REST endpoint in Splunk Enterprise (CVSS 8.0)
- [CVE-2026-20162](https://cve.now/CVE-2026-20162.md): Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise (CVSS 6.3)
- [CVE-2026-20166](https://cve.now/CVE-2026-20166.md): Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise (CVSS 5.4)
- [CVE-2026-20164](https://cve.now/CVE-2026-20164.md): Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise (CVSS 6.5)
- [CVE-2026-20165](https://cve.now/CVE-2026-20165.md): Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise (CVSS 6.3)
- [CVE-2026-20142](https://cve.now/CVE-2026-20142.md): Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise (CVSS 6.8)
- [CVE-2026-20138](https://cve.now/CVE-2026-20138.md): Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise (CVSS 6.8)
- [CVE-2026-20139](https://cve.now/CVE-2026-20139.md): Client-Side Denial of Service (DoS) through ''/splunkd/\_\_raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise (CVSS 4.3)
- [CVE-2026-20144](https://cve.now/CVE-2026-20144.md): Sensitive Information Disclosure in ''\_internal'' index in Splunk Enterprise (CVSS 6.8)
- [CVE-2026-20141](https://cve.now/CVE-2026-20141.md): Improper Access Control in Splunk Monitoring Console App (CVSS 4.3)
- [CVE-2026-20137](https://cve.now/CVE-2026-20137.md): Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise (CVSS 3.5)
- [CVE-2025-20388](https://cve.now/CVE-2025-20388.md): Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise (CVSS 2.7)
- [CVE-2025-20389](https://cve.now/CVE-2025-20389.md): Improper Input Validation in "label" column field in Splunk Secure Gateway App (CVSS 4.3)
- [CVE-2025-20387](https://cve.now/CVE-2025-20387.md): Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/splunk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.