CVE-2026-76399: Incorrect Permission Assignment for Critical Resource

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

PT-2026-78570

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware version FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 Description A flaw exists in the interface between the Baseboard Management Controller BMC—a specialized processor used for remote...

PT-2026-78752

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A Cross-Site Scripting XSS issue exists where a user with t...

CVE-2026-16835: Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

CVE-2026-76333: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

CVE-2026-76324: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...

PT-2026-78582

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 IBM Power Systems Firmware versions FW1060.00 through FW1060.80 IBM Power Systems Firmware versions FW950.00 through FW950.H2 IBM Power System...

PT-2026-78567

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 IBM Power Systems Firmware versions FW1060.00 through FW1060.80 IBM Power Systems Firmware versions FW950.00 through FW950.H2 IBM Power System...

CVE-2026-17093: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level acce...

CVE-2026-76397: Authorization Bypass Through User-Controlled Key

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-17429: Incorrect Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 Power9, and OP940.00 - OP940.81 Power HMC is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with...

CVE-2026-16930: Missing Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system,...

CVE-2026-18848: Cross-Site Request Forgery (CSRF)

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific condition...

PT-2026-78826

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-16832: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service...

PT-2026-78566

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware version FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 IBM Power Systems Firmware versions FW1060.00 through FW1060.80 IBM Power Systems Firmware versions FW950.00 through FW950.H2...

PT-2026-78574

Name of the Vulnerable Software and Affected Versions IBM Power Firmware version FW1120.00 IBM Power Firmware versions FW1110.00 through FW1110.30 IBM Power Firmware versions FW1060.00 through FW1060.80 Description A flaw in the host firmware allows an attacker with service access to the service...

PT-2026-78584

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware version FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 IBM Power Systems Firmware versions FW1060.00 through FW1060.80 Description A missing authorization issue exists in the interface...

CVE-2026-76346: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...

PT-2026-78562

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory...