PT-2026-80218

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

PT-2026-78302

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

PT-2026-78305

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

PT-2026-78280

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

PT-2026-78825

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

PT-2026-78742

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can execute arbitrary...

PT-2026-78737

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user possessing an embedded report token...

PT-2026-78728

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

PT-2026-78733

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

PT-2026-78723

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Description A user without admin or power roles can force the Splunk App for Splunk Observability Cloud to forward...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

PT-2026-78784

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can execute arbitrary code by submitting a crafted file path to the Representational State Transfer REST API. This occurs because the REST API does...

PT-2026-78771

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can write dispatch...

PT-2026-78782

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can retrieve information from Edge Processor pipeline configurations when the Edge Processor is enabled. This occurs because the Edge Processor service REST API...

PT-2026-78772

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description A user with a high-privilege role capable of managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations accessible by the...

PT-2026-78781

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can compromise system...

PT-2026-78797

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user with restricted tenant access can use the Representational State Transfer REST API to view the names and identifiers of tenants that are outside their assigned role scope...

PT-2026-78793

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...