CVE-2026-76321

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, Splunk Web fails to escape caller-supplied values when building SPL for nearby-event searches, and embedded report access accepts those requests without authorization checks, allowing unauthenticated users to inject arbitrary...