EUVD-2026-62898

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

EUVD-2026-63129

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76333

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

CVE-2026-76322

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76334 SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

CVE-2026-76334

CVE-2026-76334 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) affecting the Dashboard Studio component. A user holding the "power" role can store a workflow action containing attacker-controlled SPL. When another authenticated user selec...

CVE-2026-76333 Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...

CVE-2026-76333

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient URL validation in Dashboard Studio workflow actions. A user holding the "power" role can store a crafted URL in a workflow ac...

CVE-2026-76322

CVE-2026-76322 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 ) affecting the Dashboard Studio component. A user holding the "user" role can craft a dashboard that executes attacker-controlled Search Processing Language (SPL) in the conte...

CVE-2026-76322 SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

PT-2026-78760

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Dashboard Studio fails to sufficiently validate...

CVE-2026-20252

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to...

CVE-2026-20252 Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to...

EUVD-2026-36086

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to...

CVE-2026-20252

Splunk Enterprise and Splunk Cloud Platform are affected by CVE-2026-20252 due to an SSRF in Dashboard Studio PDF export. A low-privilege user (not admin/power role) can cause server-side requests to arbitrary internal destinations by abusing the PDF export feature. Root cause: trusted-domain val...

PT-2026-48492

🚨 CVE-2026-20252 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send...

Splunk Enterprise 服务端请求伪造漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. There are code vulnerabilities in...

EUVD-2025-8426

Malicious code in bioql PyPI...

The vulnerability of the Splunk Dashboard Studio web interface on the Splunk Web platform for operational analysis in the Splunk Enterprise environment allows a hacker to disclose protected information.

The vulnerability of the Splunk Dashboard Studio web interface of the Splunk Enterprise operating analysis platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information by bypassing the modal dialog box...

CVE-2025-20227

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content...