SC
Product
Splunk Cloud Platform
109
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 32Medium 71Low 5
Watch
Add Splunk Cloud Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-20325 | 5.3 | Jul 7 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software… Affected: 9.2.2406 before 9.2.2406.119; 9.3.2408 before 9.3.2408.113; 9.3.2411 before 9.3.2411.103 |
| CVE-2024-36996 | 5.3 | Jul 1 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists… Affected: 9.1.2312 before 9.1.2312.109 |
| CVE-2023-32710 | 5.3 | Jun 1 | In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer… Affected: before 9.0.2303.100 |
| CVE-2026-20144 | 4.9 | Feb 18 | Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise Affected: 10.1.2507 before 10.1.2507.11; 10.0.2503 before 10.0.2503.9; 9.3.2411 before 9.3.2411.120 |
| CVE-2025-20370 | 4.9 | Oct 1 | In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role… Affected: 9.2.2406 before 9.2.2406.123; 9.3.2408 before 9.3.2408.118; 9.3.2411 before 9.3.2411.108 |
| CVE-2025-20385 | 4.8 | Dec 3 | Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise Affected: 10.1.2507 before 10.1.2507.6; 10.0.2503 before 10.0.2503.7; 9.3.2411 before 9.3.2411.117 |
| CVE-2022-43561 | 4.8 | Nov 3 | Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise Affected: before 9.0.2208 |
| CVE-2026-20203 | 4.3 | Apr 15 | Improper Access Control in Data Model Acceleration in Splunk Enterprise Affected: 10.4.2603 before Not Affected; 10.3.2512 before 10.3.2512.6; 10.2.2510 before 10.2.2510.10; 10.1.2507 before 10.1.2507.19; 10.0.2503 before 10.0.2503.13; 9.3.2411 before 9.3.2411.127 |
| CVE-2026-20139 | 4.3 | Feb 18 | Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise Affected: 10.2.2510 before 10.2.2510.3; 10.1.2507 before 10.1.2507.8; 10.0.2503 before 10.0.2503.9; 9.3.2411 before 9.3.2411.121 |
| CVE-2025-20383 | 4.3 | Dec 3 | Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app Affected: 10.1.2507 before 10.1.2507.6; 10.0.2503 before 10.0.2503.8; 9.3.2411 before 9.3.2411.120 |
| CVE-2025-20322 | 4.3 | Jul 7 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated… Affected: 9.2.2406 before 9.2.2406.119; 9.3.2408 before 9.3.2408.113; 9.3.2411 before 9.3.2411.104 |
| CVE-2025-20321 | 4.3 | Jul 7 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated… Affected: 9.2.2406 before 9.2.2406.119; 9.3.2408 before 9.3.2408.114; 9.3.2411 before 9.3.2411.104 |
| CVE-2025-20300 | 4.3 | Jul 7 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user… Affected: 9.2.2406 before 9.2.2406.118; 9.3.2408 before 9.3.2408.112; 9.3.2411 before 9.3.2411.103 |
| CVE-2025-20227 | 4.3 | Mar 26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and… Affected: 9.1.2308 before 9.1.2308.214; 9.1.2312 before 9.1.2312.208; 9.2.2403 before 9.2.2403.115; 9.2.2406.100 before 9.2.2406.113; 9.3.2408.100 before 9.3.2408.107 |
| CVE-2024-53245 | 4.3 | Dec 10 | In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“… Affected: 9.1.2312 before 9.1.2312.206 |
| CVE-2024-45735 | 4.3 | Oct 14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user… Affected: before 3.4.259; 3.6.0 before 3.6.17 |
| CVE-2023-32717 | 4.3 | Jun 1 | On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the… Affected: before 9.0.2303.100 |
| CVE-2023-32709 | 4.3 | Jun 1 | In Splunk Enterprise versions below 9.0.5, 8.2.11 Affected: before 9.0.2303.100 |
| CVE-2023-22938 | 4.3 | Feb 14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance Affected: before 9.0.2209.3 |
| CVE-2023-22937 | 4.3 | Feb 14 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions Affected: before 9.0.2209.3 |
| CVE-2023-22931 | 4.3 | Feb 14 | In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without… Affected: before 8.2.2203 |