SE
Product
Splunk Enterprise
On CISA KEVExploited in the wild
216
CVEs
1
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 10High 72Medium 128Low 6
Watch
Add Splunk Enterprise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76318 | 5.4 | Aug 19 | Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76263 | 5.4 | Aug 19 | Improper Access Control through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6 |
| CVE-2026-20258 | 5.4 | Jun 10 | Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise Affected: 10.2 before 10.2.4; 10.0 before 10.0.7; 9.4 before 9.4.12; 9.3 before 9.3.13 |
| CVE-2026-20166 | 5.4 | Mar 11 | Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise Affected: 10.2 before 10.2.1; 10.0 before 10.0.4 |
| CVE-2025-20382 | 5.4 | Dec 3 | URL validation bypass through Views Dashboard in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.6; 9.3 before 9.3.8; 9.2 before 9.2.10 |
| CVE-2025-20368 | 5.4 | Oct 1 | Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise Affected: 10.0 before 10.0.0; 9.4 before 9.4.4; 9.3 before 9.3.6; 9.2 before 9.2.8 |
| CVE-2025-20367 | 5.4 | Oct 1 | Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise Affected: 10.0 before 10.0.0; 9.4 before 9.4.4; 9.3 before 9.3.6; 9.2 before 9.2.8 |
| CVE-2025-20324 | 5.4 | Jul 7 | Improper Access Control in System Source Types Configuration in Splunk Enterprise Affected: 9.4 before 9.4.2; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2025-20297 | 5.4 | Jun 2 | Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component Affected: 9.4 before 9.4.2; 9.3 before 9.3.4; 9.2 before 9.2.6; 9.1 before 9.1.9 |
| CVE-2024-45741 | 5.4 | Oct 14 | Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise Affected: 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2024-45740 | 5.4 | Oct 14 | Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise Affected: 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2024-36993 | 5.4 | Jul 1 | Persistent Cross-site Scripting (XSS) in Web Bulletin Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2024-36992 | 5.4 | Jul 1 | Persistent Cross-site Scripting (XSS) in Dashboard Elements Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2024-36994 | 5.4 | Jul 1 | Persistent Cross-site Scripting (XSS) in Dashboard Elements Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2022-43569 | 5.4 | Nov 4 | Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2022-43562 | 5.4 | Nov 4 | Host Header Injection in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2026-76281 | 5.3 | Oct 7 | Improper Access Control in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76340 | 5.3 | Aug 19 | Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2 |
| CVE-2026-76337 | 5.3 | Aug 19 | Path Traversal through Splunk Web Static File Serving in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2025-20384 | 5.3 | Dec 3 | Unauthenticated Log Injection in Splunk Enterprise Affected: 10.0 before 10.0.1; 9.4 before 9.4.6; 9.3 before 9.3.8; 9.2 before 9.2.10 |
| CVE-2025-20325 | 5.3 | Jul 7 | Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2024-36996 | 5.3 | Jul 1 | Information Disclosure of user names Affected: 9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 |
| CVE-2024-23677 | 5.3 | Jan 22 | Server Response Disclosure in RapidDiag Salesforce.com Log File Affected: 9.0 before 9.0.8 |
| CVE-2026-20142 | 4.9 | Feb 18 | Sensitive Information Disclosure in "_internal" index in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.7; 9.3 before 9.3.9; 9.2 before 9.2.11 |
| CVE-2026-20138 | 4.9 | Feb 18 | Sensitive Information Disclosure in "_internal" index in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.7; 9.3 before 9.3.9; 9.2 before 9.2.11 |
| CVE-2026-20144 | 4.9 | Feb 18 | Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.7; 9.3 before 9.3.8; 9.2 before 9.2.11 |
| CVE-2025-20370 | 4.9 | Oct 1 | Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise Affected: 10.0 before 10.0.1; 9.4 before 9.4.4; 9.3 before 9.3.6; 9.2 before 9.2.8 |
| CVE-2024-45739 | 4.9 | Oct 14 | Sensitive information disclosure in AdminManager logging channel Affected: 9.3 before 9.3.1; 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2024-45738 | 4.9 | Oct 14 | Sensitive information disclosure in REST_Calls logging channel Affected: 9.3 before 9.3.1; 9.2 before 9.2.3; 9.1 before 9.1.6 |
| CVE-2025-20385 | 4.8 | Dec 3 | Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.6; 9.3 before 9.3.8; 9.2 before 9.2.10 |
| CVE-2023-46213 | 4.8 | Nov 16 | Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page Affected: 9.0 before 9.0.7; 9.1 before 9.1.2 |
| CVE-2022-43561 | 4.8 | Nov 3 | Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise Affected: 8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 |
| CVE-2026-76296 | 4.3 | Oct 21 | Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76295 | 4.3 | Oct 21 | SPL Injection through the REST API in Splunk Secure Gateway Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76294 | 4.3 | Oct 21 | Improper Access Control in Field Extraction Management in Splunk Enterprise Affected: 10.4 before 10.4.4; 10.2 before 10.2.8; 10.0 before 10.0.11; 9.4 before 9.4.16 |
| CVE-2026-76279 | 4.3 | Oct 7 | Improper Input Validation of Index Names through the collect Command in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76278 | 4.3 | Oct 7 | Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76276 | 4.3 | Oct 7 | Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76275 | 4.3 | Oct 7 | Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76273 | 4.3 | Oct 7 | Improper Input Validation through the collect Command in Splunk Enterprise Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76272 | 4.3 | Oct 7 | Missing Access Control through the REST API in Splunk Secure Gateway Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76267 | 4.3 | Oct 7 | Log Injection through the REST API in Splunk App for Splunk O11y Cloud Affected: 10.4 before 10.4.3; 10.2 before 10.2.7; 10.0 before 10.0.10 |
| CVE-2026-76264 | 4.3 | Oct 7 | Improper Authorization through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.10; 9.4 before 9.4.15 |
| CVE-2026-76309 | 4.3 | Aug 19 | Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-76256 | 4.3 | Aug 19 | Information Exposure through REST API Endpoints in Splunk Secure Gateway Affected: 10.4 before 10.4.2; 10.2 before 10.2.6; 10.0 before 10.0.9; 9.4 before 9.4.14 |
| CVE-2026-20203 | 4.3 | Apr 15 | Improper Access Control in Data Model Acceleration in Splunk Enterprise Affected: 10.2 before 10.2.2; 10.0 before 10.0.5; 9.4 before 9.4.10; 9.3 before 9.3.11 |
| CVE-2026-20139 | 4.3 | Feb 18 | Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise Affected: 10.0 before 10.0.2; 9.4 before 9.4.8; 9.3 before 9.3.9; 9.2 before 9.2.12 |
| CVE-2025-20383 | 4.3 | Dec 3 | Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app Affected: 10.0 before 10.0.2; 9.4 before 9.4.6; 9.3 before 9.3.8; 9.2 before 9.2.10 |
| CVE-2025-20322 | 4.3 | Jul 7 | Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |
| CVE-2025-20323 | 4.3 | Jul 7 | Missing Access Control of Saved Searches in the Splunk Archiver app Affected: 9.4 before 9.4.3; 9.3 before 9.3.5; 9.2 before 9.2.7; 9.1 before 9.1.10 |