CVE-2026-76319

Splunk Enterprise federated search dispatch flow accepts caller-controlled bundle selection without enforcing the fsh_manage capability, enabling a low-privileged user to achieve remote code execution. CVSS 8.8 (High). Affected versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14 ; upgrade to one of the...

CVE-2026-76318

Splunk Web renders alert trigger condition threshold values into markup without escaping special characters, allowing a low-privilege user (schedule_search role) to inject persistent XSS. Exploitation requires a victim to open a crafted link, enabling script execution and full access to that user...

CVE-2026-76318 Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could...

CVE-2026-76314 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...

CVE-2026-76313 Remote Code Execution (RCE) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

CVE-2026-18466

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

EUVD-2026-62280

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-18466

The WP Maps WordPress plugin (versions before 4.9.8 ) contains a vulnerability where one of its AJAX actions fails to perform a capability check or validate a nonce . This flaw allows users with a Subscriber account to create an unlimited number of options in the database. Each created option is ...

CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565

The Advanced File Manager WordPress plugin (versions prior to 5.4.13 ) contains a vulnerability where it fails to perform proper capability checks in several file management AJAX actions , specifically involving the fma_load_fma_ui function. This flaw allows users with specific roles—even as low ...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

EUVD-2025-210740

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

PT-2026-78779

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Users without admin or power roles can create or modify...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

CVE-2026-76396: Improper Privilege Management

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

CVE-2026-11565: Undefined Security Weakness

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...