SP
Product
Splunk
On CISA KEVExploited in the wild
286
CVEs
2
On KEV
10.0
Max CVSS
22
New 30D
Severity mix
Critical 12High 89Medium 149Low 9
Watch
Add Splunk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76348 | 3.8 | Aug 19 | Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise Affected: 9.4.0 before 9.4.14; 10.0.0 before 10.0.9; 10.2.0 before 10.2.6; 10.4.0 before 10.4.2 |
| CVE-2025-20379 | 3.5 | Nov 12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a… Affected: 9.2.0 before 9.2.9; 9.3.0 before 9.3.7; 9.4.0 before 9.4.5; 10.0.0 |
| CVE-2024-45737 | 3.5 | Oct 14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the… Affected: 9.1.0 before 9.1.6; 9.2.0 before 9.2.3; 9.3.0 |
| CVE-2024-36995 | 3.5 | Jul 1 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the… Affected: 9.0.0 before 9.0.10; 9.1.0 before 9.1.5; 9.2.0 before 9.2.2 |
| CVE-2024-23676 | 3.5 | Jan 22 | In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view Affected: 9.0.0 before 9.0.8; 9.1.0 before 9.1.3 |
| CVE-2022-37438 | 3.5 | Aug 16 | In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real… Affected: 8.1.0 before 8.1.11; 8.2.0 before 8.2.7.1; 9.0.0 |
| CVE-2017-5607 | 3.5 | Apr 10 | Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk… Affected: through 6.5.1; 5.0.0 before 5.0.18; 6.0.0 before 6.0.14; 6.1.0 before 6.1.13; 6.2.0 before 6.2.13.1; 6.3.0 before 6.3.10; +2 more |
| CVE-2023-32712 | 3.1 | Jun 1 | In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that,… Affected: 8.1.0 before 8.1.14; 8.2.0 before 8.2.11; 9.0.0 before 9.0.5 |
| CVE-2025-20388 | 2.7 | Dec 3 | In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role… Affected: 9.2.0 before 9.2.10; 9.3.0 before 9.3.8; 9.4.0 before 9.4.6; 10.0.0 |
Showing 9