CVE-2025-36255

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-s3 versions 23.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions 14.0.4...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-cloudinary versions 26.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-dos versions 23.0.4...

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-76398 Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76397

Splunk AI Toolkit versions below 6.0.0 are affected: a user with the "power" Splunk role can access and delete all experiment history data, including other users' data, because the tool does not preserve the trusted experiment scope when processing caller-controlled query values. CVSS 8.1 (HIGH) ...

CVE-2026-76398

Splunk AI Toolkit versions below 6.0.1 are affected by an improper access control vulnerability in the REST API. A user without the "admin" or "power" Splunk role can delete the experiment history of another user without authorization. The root cause is that the toolkit deletes experiment history...

CVE-2026-76397 Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76396

Splunk AI Toolkit versions below 6.0.0 fail to mark the apply search command as risky, allowing users with the schedule_search capability to trigger deserialization of arbitrary model files via scheduled searches. This can lead to code execution with high confidentiality, integrity, and availabil...

CVE-2026-76396 Improper Access Control through Scheduled Searches in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-76312 Improper Access Control through Embedded Reports in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language HTML source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerabilit...

CVE-2026-76311

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded report authorization flow. The flow fails to block dispatch archive download requests before the archive is sent to the requester, allowing an unauthenticated user p...

CVE-2026-76312

Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 are affected by an improper access control flaw in the embedded-report dispatch archive download path. The path fails to enforce the embedded-report authorization boundary and includes sensitive session material in archived searc...

CVE-2026-76311 Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76310 Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76310

An unauthenticated user with an embedded report token can download the search job dispatch archive via REST API, recover session material, and access all data available to the report owner—including admin-level actions—due to embedded report access not blocking dispatch archive downloads. Affecte...