Vendor
Splunk
- CVEs tracked · all time
- 20
- in CISA KEV · all time
- 1
- articles · since 11 Sep
- 2
- articles · all time
- 16
2 articles since 11 Sep.
Show as table
| Day (UTC) | Articles |
|---|---|
| Thu 8 Oct | 1 |
| Thu 22 Oct | 1 |
Products: Enterprise, Splunk AI Toolkit, Splunk Cloud Platform, Splunk Enterprise and 2 more
EnterpriseSplunk AI ToolkitSplunk Cloud PlatformSplunk EnterpriseSplunk MCP Server appSplunk Secure Gateway
CVEs
20 CVEsCVE-2026-20253Splunk Enterprise Missing Authentication for Critical Function VulnerabilityCVSS9.8CriticalExploited97%EPSS8articles
CVE-2026-76298Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk EnterpriseCVSS8.8High–Not in KEV0.3%EPSS1article
CVE-2026-76291Improper Access Control through Scheduled Search Safeguards in Splunk EnterpriseCVSS8.8High–Not in KEV0.3%EPSS1article
CVE-2026-76290Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk EnterpriseCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-76288Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk EnterpriseCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-76293Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk EnterpriseCVSS7.2High–Not in KEV0.3%EPSS1article
CVE-2026-76531Files or Directories Accessible to External Parties in Splunk SOARCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-76268Missing Authentication for Critical Function in the Patroni REST API in Splunk EnterpriseCVSS9.8Critical–Not in KEV4.8%EPSS1article
CVE-2026-76266Local Privilege Escalation through Linux Package Upgrades in Splunk EnterpriseCVSS7.7High–Not in KEV0.1%EPSS1article
CVE-2026-76264Improper Authorization through the REST API in Splunk EnterpriseCVSS4.3Medium–Not in KEV0.2%EPSS1article
CVE-2026-76404Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server appCVSS9.1Critical–Not in KEV0.8%EPSS1article
8 more CVEs
CVE-2026-20296SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk EnterpriseCVSS8.3High–Not in KEV0.2%EPSS1article
CVE-2026-20297Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk EnterpriseCVSS7.2High–Not in KEV0.6%EPSS1article
CVE-2026-20298Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk EnterpriseCVSS5.3Medium–Not in KEV0.3%EPSS1article
CVE-2026-20265Insecure Default Domain Allowlist in Splunk AI ToolkitCVSS4.3Medium–Not in KEV0.2%EPSS2articles
CVE-2026-20252Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk EnterpriseCVSS7.6High–Not in KEV0.3%EPSS1article
CVE-2026-20258Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk EnterpriseCVSS7.1High–Not in KEV0.2%EPSS1article
CVE-2026-20163Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk EnterpriseCVSSUnrated–Not in KEV0.5%EPSS1article
- Splunk fixes 31 flaws, including three rated CVSS 9.9, in urgent updatesSecurityOnline
- Splunk Patches Critical Unauthenticated RCE in Enterprise Search ClustersSecurityOnline
- Splunk patches critical RCE flaw in MCP Server app, urges updatesSecurityOnline
- Splunk patches AI Toolkit OS command injection flaw CVE-2026-20266SecurityOnline
- Splunk and Zoom patch critical flaws, including CVE-2026-53412SecurityWeek
- CVE-2026-20253 Splunk bug lets hackers run code remotelySOCRadar
- CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21Security Affairs
- Splunk Enterprise Vulnerability Exploited in Attacks Days After DisclosureSecurityWeek
- CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging PatchesCISA · official notice
- CISA flags critical Splunk flaw enabling unauthenticated file editsCISA · official notice
- Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the WildSecurityOnline
- Atlassian, Splunk release patches for critical AI Toolkit flawSecurityWeek
- Splunk AI Toolkit flaw allows arbitrary command executionSecurityOnline
- Palo Alto fixes Cortex flaw: Splunk patches Enterprise bugSecurityWeek
- Check Point VPN under attack as Splunk issues urgent patchesSecurityOnline
- Splunk, Zoom Patch Severe VulnerabilitiesSecurityWeek · first in our coverage