Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Splunk Enterprise 10.0.9, 10.2.6 and 2 more versions Clear all filters
TI-2026-53383 CVE-2026-76328 · GHSA-pr6c-rjcv-qm29

SPL Injection through Splunk Web in Splunk Enterprise

Priority LOW 31

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00282 Published 2026-08-19 Fixed in 10.4.1, 10.2.6 +2 CWE-77
TI-2026-53367 CVE-2026-76312 · GHSA-8x8r-pr28-52g6

Improper Access Control through Embedded Reports in Splunk Enterprise

Priority MEDIUM 49

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session mat…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00446 Published 2026-08-19 Fixed in 10.4.1, 10.2.6 +2 CWE-284