CVE-2026-76318 Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could...

CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

CVE-2026-76253 Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

CVE-2026-71138

creationtimestamp| type| source ---|---|--- 2026-08-19 18:17:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-71046

creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:36+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu23bektc22v...

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-60757

creationtimestamp| type| source ---|---|--- 2026-08-19 18:16:00+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

UBUNTU-CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-60766

creationtimestamp| type| source ---|---|--- 2026-08-19 18:15:34+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70949

creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:30+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 07:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu2dnkv4652v...

CVE-2026-71117

creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:13+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-71106

creationtimestamp| type| source ---|---|--- 2026-08-19 17:50:36+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70965

creationtimestamp| type| source ---|---|--- 2026-08-19 17:50:09+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu26mndmym24...

CVE-2026-70877

creationtimestamp| type| source ---|---|--- 2026-08-19 17:46:29+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu2lzs4exh2h...

CVE-2026-70891

creationtimestamp| type| source ---|---|--- 2026-08-19 17:45:18+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

EUVD-2026-62597

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...

CVE-2026-17183

In Grafana OSS (confirmed 13.0.1), the Unified Alerting/ngalert component skips datasource authorization when queryType equals __expr__, but execution uses the real datasourceUid. An authenticated low-privileged user can set queryType: "__expr__" with a real datasource UID to bypass datasources:q...

CVE-2026-17183 CVE-2026-17183 CVE Record

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...