CVE-2026-73779

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

EUVD-2026-69642

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

EUVD-2026-62917

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76353

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76331

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

CVE-2026-76311

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76399 Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-76391

In Splunk AI Toolkit versions below 6.0.0, the Agent Run History handler swaps the caller's session key for a system token, allowing low-privilege users to run system-level searches, access all data, and read or delete other users' search jobs. CVSS 3.1 scores 8.3 (HIGH). No exploitation evidence...

CVE-2026-76352

CVE-2026-76352 is an improper authorization vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. An...

CVE-2026-76315 Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect syste...

CVE-2026-76311 Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

PT-2026-78738

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user possessing an embedded report token...

CVE-2026-73416

A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...

CVE-2026-18098 IBM i is Affected By XML injection flaw in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw...

CVE-2026-18098

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw...

CVE-2026-18098

CVE-2026-18098 affects IBM i releases 7.3, 7.4, 7.5, and 7.6. The vulnerability is described as an XML injection flaw in Navigator for i, leading to a remote authenticated attacker obtaining sensitive information and potentially compromising system integrity. IBM’s remediation involves platform f...

EUVD-2026-57348

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw...

PT-2026-71163

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw...

PT-2026-70783

Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description Improper link resolution before file access, known as link following, occurs in the unionfs.sys driver. This allows an authorized attacker to...