Splunk Splunk Enterprise

• CVE-2026-20296 High 8.3 SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise 0.2%
• CVE-2026-20297 High 7.2 Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise 0.6%
• CVE-2026-20258 High 7.1 Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise 0.2%
• CVE-2026-20252 High 7.6 Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise 0.3%
• CVE-2026-20257 Medium 5.7 Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise 0.3%
• CVE-2026-20259 Medium 5.5 Improper Access Control in Splunk Enterprise 0.2%
• CVE-2026-20255 Medium 5.7 Improper Input Validation through Classic Dashboards in Splunk Enterprise 0.4%
• CVE-2026-20251 High 8.8 Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway 30.6%
• CVE-2026-20254 Medium 5.7 Information Disclosure through External Content Restriction Bypass in Splunk Enterprise 0.4%
• CVE-2026-20256 Medium 5.7 Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise 0.4%
• CVE-2026-20239 High 7.5 Sensitive Information Disclosure through Log Files in Splunk Enterprise 0.5%
• CVE-2026-20240 High 7.1 Denial of Service through coldToFrozen.sh Script in Splunk Enterprise 0.4%
• CVE-2026-20203 Medium 4.3 Improper Access Control in Data Model Acceleration in Splunk Enterprise 0.2%
• CVE-2026-20204 High 7.1 Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise 3.1%
• CVE-2026-20202 Medium 6.6 Improper Input Validation during User Account Creation in Splunk Enterprise 0.2%
• CVE-2026-20163 High 8.0 Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise 0.5%
• CVE-2026-20162 Medium 6.3 Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise 0.2%
• CVE-2026-20166 Medium 5.4 Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise 0.2%
• CVE-2026-20164 Medium 6.5 Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise 0.3%
• CVE-2026-20165 Medium 6.3 Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise 0.2%
• CVE-2026-20142 Medium 6.8 Sensitive Information Disclosure in "_internal" index in Splunk Enterprise 0.3%
• CVE-2026-20138 Medium 6.8 Sensitive Information Disclosure in "_internal" index in Splunk Enterprise 0.3%
• CVE-2026-20139 Medium 4.3 Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise 5.7%
• CVE-2026-20144 Medium 6.8 Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise 0.3%
• CVE-2026-20141 Medium 4.3 Improper Access Control in Splunk Monitoring Console App 0.2%
• CVE-2026-20137 Low 3.5 Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise 0.3%
• CVE-2025-20388 Low 2.7 Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise 0.4%
• CVE-2025-20389 Medium 4.3 Improper Input Validation in "label" column field in Splunk Secure Gateway App 0.4%
• CVE-2025-20387 High 8.0 Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade 0.5%
• CVE-2025-20383 Medium 4.3 Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app 0.3%
• CVE-2025-20384 Medium 5.3 Unauthenticated Log Injection in Splunk Enterprise 0.4%
• CVE-2025-20386 High 8.0 Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade 0.5%
• CVE-2025-20385 Low 2.4 Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise 0.3%
• CVE-2025-20382 Low 3.5 URL validation bypass through Views Dashboard in Splunk Enterprise 0.2%
• CVE-2025-20379 Low 3.5 Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise 0.3%
• CVE-2025-20378 Low 3.1 Open Redirect on Web Login endpoint in Splunk Enterprise 0.3%
• CVE-2025-20368 Medium 5.7 Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise 0.4%
• CVE-2025-20371 High 7.5 Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise 0.5%
• CVE-2025-20367 Medium 5.7 Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise 0.4%
• CVE-2025-20370 Medium 4.9 Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise 0.6%
• CVE-2025-20366 Medium 6.5 Improper Access Control in Background Job Submission in Splunk Enterprise 0.4%
• CVE-2025-20369 Medium 4.6 Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise 0.3%
• CVE-2025-20322 Medium 4.3 Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise 0.2%
• CVE-2025-20323 Medium 4.3 Missing Access Control of Saved Searches in the Splunk Archiver app 0.3%
• CVE-2025-20321 Medium 6.5 Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise 0.2%
• CVE-2025-20325 Low 3.1 Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise 0.4%
• CVE-2025-20319 Medium 6.8 Remote Command Execution through Scripted Input Files in Splunk Enterprise 0.5%
• CVE-2025-20324 Medium 5.4 Improper Access Control in System Source Types Configuration in Splunk Enterprise 0.3%
• CVE-2025-20320 Medium 6.3 Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise 0.5%
• CVE-2025-20300 Medium 4.3 Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise 0.3%