CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76386 Information Disclosure through Action Parameters in Zoom app for Splunk SOAR

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...

CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...

CVE-2026-76386

In Zoom app for Splunk SOAR versions below 3.2.2, the "password" and "pmi_password" action parameters are not masked, causing cleartext exposure of Zoom meeting passwords and personal meeting ID passwords in the UI when a user with action-running privileges invokes create/update meeting or update...

CVE-2026-76385

CVE-2026-76385 affects the Venafi app for Splunk SOAR in versions below 2.1.4 . The get certificate action exposes the keystore_password and password parameters in cleartext in the user interface because the app does not mark them as password fields. Any user with permission to run actions can tr...

CVE-2026-76384

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR , the archive_password parameter used by the detonate file and detonate url actions is not marked as a password by the application. As a result, the value is displayed in cleartext in the Splunk SOAR user interface, a...

CVE-2026-76384 Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archivepassword parameter is not mask...

CVE-2026-76382

In Phantom app for Splunk SOAR versions below 3.8.5, the deflate item action's password parameter is not masked, exposing sensitive archive passwords in cleartext to any user with action-run privileges. CVSS 4.3 (Medium). No exploitation details provided. Upgrade to 3.8.5 or later. See Splunk adv...

CVE-2026-76383

In RSA SecurID Authentication Manager app for Splunk SOAR versions below 1.0.5, the enable_token and revoke_token actions expose the sensitive token_serial parameter in cleartext because it is not marked as a password-type parameter. A user with action-execution privileges can view the serial in ...

CVE-2026-76382 Information Disclosure through Action Parameters in Phantom app for Splunk SOAR

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface...

CVE-2026-76383 Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's tokenserial parameter is not masked...

CVE-2026-76380

CrowdStrike OAuth API app for Splunk SOAR before 5.1.3 fails to mask the document_password parameter on its detonate file and detonate url actions, displaying it in cleartext in the UI. Any user with action-run privileges can read the password. Upgrade to version 5.1.3 or later to resolve. Exploi...

CVE-2026-76381

CVE-2026-76381 is an information disclosure vulnerability in the MS Graph for Active Directory app for Splunk SOAR , affecting versions below 1.5.2 . The root cause is that the temp_password parameter in the reset password action is not marked as a password field, causing it to be displayed in cl...

CVE-2026-76380 Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's documentpassword parameter is not masked an...

CVE-2026-76381 Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in...

CVE-2026-76379 Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user...

CVE-2026-76379

CVE-2026-76379 is an information disclosure vulnerability in the Cisco Webex app for Splunk SOAR (versions below 2.2.1 ). The root cause is that the app does not mark the password parameter of the schedule meeting action as a password field, causing it to be displayed in cleartext in the user int...

CVE-2026-76377

CVE-2026-76377 affects the Azure AD Graph app for Splunk SOAR in versions below 2.5.3 . The root cause is that the temp_password parameter in the reset password action is not marked as a password field, causing it to be displayed in cleartext in the Splunk SOAR user interface. Any user with a rol...

CVE-2026-76378 Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in...

CVE-2026-76377 Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user...