CVE-2026-76257: Missing Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access...

CVE-2026-76344: Path Traversal: 'dir/../../filename'

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76336: Missing Authorization

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76357: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

PT-2026-78821

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description Low-privileged users without admin or power roles can start, stop, and configure containers, as well as read or modify connection and configuration data. This occurs because multiple handle...

PT-2026-78763

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.2 through 10.2.5 Splunk Enterprise versions 10.4.0 through 10.4.1 Description An issue exists where the SPL2 module management Representational State Transfer REST API does not sufficiently authorize and validate...

PT-2026-78772

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description A user with a high-privilege role capable of managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations accessible by the...

CVE-2026-76313: Improper Access Control

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

PT-2026-78280

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-76315: Improper Control of Generation of Code

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect syste...

CVE-2026-60797

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks o...

EUVD-2026-61434

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of...

keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability

Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...

CVE-2026-58417

A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure...

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...

WordPress Simply Schedule Appointments plugin < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability

Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simply Schedule Appointments versions 1.6.12.17...