CVE-2026-19441

A flaw was found in Rush. This vulnerability allows an unauthenticated attacker to manipulate analytics data. By exploiting a critical function that lacks proper authentication, an attacker can falsify the origin of data. This could lead to inaccurate reporting and potentially impact business...

CVE-2026-19441

A missing authentication flaw in a critical function of IKAS Technology Inc. Rush (versions through 21082026) allows an unauthenticated, remote attacker to falsify the source of analytics data. The root cause is the absence of proper authentication on a function that handles data origin, enabling...

CVE-2026-19441 Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-19441 Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

EUVD-2026-62943

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

EUVD-2026-62897

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

CVE-2026-76999: Improper Authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76378

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

CVE-2026-76378

In Cisco Secure Malware Analytics app for Splunk SOAR versions below 2.4.5, the detonate file action's sample_password parameter is not marked as a password type, causing it to display in cleartext in the UI. Any user with action-run permissions can read the sensitive password. CVSS 3.1 scores th...

CVE-2026-76378 Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

CVE-2026-76332

Affected: Splunk Enterprise below 9.4.14, 10.0.9, 10.2.6, and 10.4.2. Root cause: Analytics Workspace fails to validate data used to build SPL searches. Impact: an unauthenticated attacker can phish an authenticated user via a crafted link; opening it executes attacker-controlled SPL with the vic...

CVE-2026-76332 SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

CVE-2026-76332 SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

crosscompute-analytics (0.9.4.9), db-classifier (0.0.2) +5 more potentially affected by CVE-2026-73415 via jupyterlab (3.6.3)

jupyterlab PYPI version 3.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - crosscompute-analytics 0.9.4.9 - db-classifier 0.0.2 - pysailingvlm =1.0.0, =8.6.5, =1.4.0, =0.1.1rc1, =0.1.1147938789 Source cves:...

BIT-ELK-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

CVE-2026-76332: Improper Input Validation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

CVE-2026-76378: Cleartext Storage of Sensitive Information

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

PT-2026-78805

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's sample password parameter is not masked and is shown in...

CVE-2026-71107

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Server. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-71099

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web Answers. The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...