CVE-2026-76255: Missing Authorization

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

CVE-2026-50720: Improper Verification of Cryptographic Signature

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-76330: Improper Input Validation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language SP...

CVE-2026-76349: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

Splunk Enterprise REST API Disclosure

The vulnerability of the REST API implementation of the Splunk Enterprise platform for operational analysis is related to insufficient protection of sensitive data when the |rest command is executed. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sendi...

Splunk Web Deployment Server Arbitrary SPL Command Information Disclosure

The vulnerability of the Deployment Server web interface of the Splunk Web platform for operational analysis in Splunk Enterprise relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary SPL commands and disclose sensitive...

Malicious code in spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654 On require, index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and package metadata, base64-encodes t...

MAL-2026-13351 Malicious code in spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654 On require, index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and package metadata, base64-encodes t...

Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

MAL-2026-13214 Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

Malicious code in @wethenorth12/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7f9cee39cc030c866ec58a0744ef387333cf5578a35f4b10aa211c19c61b7b @wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require, index.js serializes the full process.env...

Malicious Package

Overview @zzzgenesis00/spl-token-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @zzzgenesis00/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ad6fd0f8ef16ee23b458b541d9cdfc73147e768ec9f8676ed50b30996231813 postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host. Collected data includes hos...

CVE-2026-20296

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the listdeploymentserver capability into running arbitrary...

CVE-2026-20296 SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the listdeploymentserver capability into running arbitrary...

CVE-2026-20296: Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the listdeploymentserver capability into running arbitrary...

AZL-91113 CVE-2026-55892 affecting package vim for versions less than 9.2.0735-1

Vim is an open source, command line text editor. Prior to 9.2.0662, the dumpprefixes function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never check...

ALPINE-CVE-2026-55892

Vim is an open source, command line text editor. Prior to 9.2.0662, the dumpprefixes function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never check...

CVE-2026-55892

Vim is an open source, command line text editor. Prior to 9.2.0662, the dumpprefixes function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never check...

Malicious code in @solana-labs/spl-toke (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e2ec34996ab8cff20d9ba12cd9f5a8a75346c4e5e25d7c3fd5adc7bb7045f64 Package name @solana-labs/spl-toke is a likely confusion-attack against the well-known @solana/spl-token SPL token client missing trailing n, differe...