SE
Product
Splunk Enterprise
On CISA KEVExploited in the wild
127
CVEs
1
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 10High 48Medium 68Low 1
Watch
Add Splunk Enterprise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76324 | 5.4 | Aug 19 | Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76318 | 5.4 | Aug 19 | Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76263 | 5.4 | Aug 19 | Improper Access Control through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6 |
| CVE-2026-20258 | 5.4 | Jun 10 | Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise Affected: 10.2 before 10.2.4; 10.0 before 10.0.7; 9.4 before 9.4.12; 9.3 before 9.3.13 |
| CVE-2022-43569 | 5.4 | Nov 4 | Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2022-43562 | 5.4 | Nov 4 | Host Header Injection in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2026-76281 | 5.3 | Oct 7 | Improper Access Control in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76340 | 5.3 | Aug 19 | Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2 |
| CVE-2026-76337 | 5.3 | Aug 19 | Path Traversal through Splunk Web Static File Serving in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2022-43561 | 4.8 | Nov 3 | Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2026-76296 New | 4.3 | Oct 21 | Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76295 New | 4.3 | Oct 21 | SPL Injection through the REST API in Splunk Secure Gateway Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76294 New | 4.3 | Oct 21 | Improper Access Control in Field Extraction Management in Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76279 | 4.3 | Oct 7 | Improper Input Validation of Index Names through the collect Command in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76278 | 4.3 | Oct 7 | Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76276 | 4.3 | Oct 7 | Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76275 | 4.3 | Oct 7 | Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76273 | 4.3 | Oct 7 | Improper Input Validation through the collect Command in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76272 | 4.3 | Oct 7 | Missing Access Control through the REST API in Splunk Secure Gateway Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76267 | 4.3 | Oct 7 | Log Injection through the REST API in Splunk App for Splunk O11y Cloud Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76264 | 4.3 | Oct 7 | Improper Authorization through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76309 | 4.3 | Aug 19 | Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76256 | 4.3 | Aug 19 | Information Exposure through REST API Endpoints in Splunk Secure Gateway Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-20203 | 4.3 | Apr 15 | Improper Access Control in Data Model Acceleration in Splunk Enterprise Affected: 10.2 before 10.2.2; 10.0 before 10.0.5; 9.4 before 9.4.10; 9.3 before 9.3.11 |
| CVE-2026-76297 New | 4.2 | Oct 21 | Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76277 | 4.1 | Oct 7 | Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76348 | 3.8 | Aug 19 | Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |