EUVD-2026-63133

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all...

CVE-2026-76326

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 have a stored XSS flaw: the dashboard table renderer fails to escape tooltip content, allowing a non-admin user to inject JavaScript that executes when another user hovers over a sparkline cell. Exploitation details are not provi...