EUVD-2026-62906

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

CVE-2026-76255

Splunk Enterprise versions below 9.4.13, 10.0.8, 10.2.6, and 10.4.1 are vulnerable: Splunk Web omits SPL safeguards in the Data Model Editor's base search, allowing a low-privilege user to phish another into executing arbitrary SPL commands with the victim's privileges, compromising confidentiali...