PT-2026-78536

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description A flaw in the search-v2-operator allows a privileged user with Custom Resource CR editor permissions to manipulate Search CR fields without proper validation. The affected fields...

PT-2026-78748

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can inject arbitrary Search...

PT-2026-78561

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description An issue exists where the operator's ClusterRole is granted permissions equivalent to a cluster administrator. This allows the operator to impersonate other entities, write...

CVE-2026-76329: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing...

PT-2026-79862

Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memor...

PT-2026-78394

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description When configured to use PostgreSQL via the native pgsql PHP extension, the software declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend, while the...

PT-2026-79863

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...

PT-2026-79982

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

PT-2026-79860

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one...

CVE-2026-76345: Improper Access Control

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

PT-2026-78744

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can move files readable...

CVE-2026-76354: Improper Neutralization of Null Byte or NUL Character

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-71056

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Search. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-71031

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2026-71032

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2026-71021

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT...

CVE-2026-70994

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2026-70997

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-70704

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite component: Party Search UI. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trading...

CVE-2026-60757

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Search. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel...