CVE-2026-76258

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile us...

CVE-2026-76591

The TRENDnet TEW-755AP's log_email_server function in /cgi-bin/email.cgi (ssi component) is vulnerable to remote command injection. CVSS 3.1 scores it HIGH (7.4); a public PoC exploit exists at https://github.com/meishigana/CVE/tree/main/team15_20260702/14_755ap-ssi-cmdi. No patch version or vend...

CVE-2026-76591 TRENDnet TEW-755AP ssi email.cgi log_email_server command injection

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function logemailserver of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-76832 Agno PythonTools Path Traversal via joinpath file_name argument

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

CVE-2026-76387

In Splunk Enterprise Security versions below 8.6.1, the Analyst Queue search filter handling does not validate filter field names before inclusion in SPL searches. A user with the mc_investigation_read capability can inject SPL, gaining access to all data and system integrity available to their s...

CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

CVE-2026-76373

In AD LDAP app for Splunk SOAR versions below 2.3.8, a low-privilege user can inject crafted input into Active Directory queries via action parameters, enabling enumeration of accounts/groups/OUs, reading sensitive attributes from arbitrary objects, and redirecting account-modification actions. C...

CVE-2026-76373 Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from...

CVE-2026-76365 Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on a...

CVE-2026-76365

Splunk SOAR versions below 8.6.0 are affected by a SQL injection vulnerability in the custom list retrieval feature of playbooks. The root cause is that Splunk SOAR constructs the custom list database lookup using the supplied list name directly in the query instead of a bound SQL parameter , all...

CVE-2026-76364 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database...

CVE-2026-76364

In Splunk SOAR versions below 8.6.0, a user holding the "Automation Engineer" role can inject arbitrary SQL via custom function results, because Splunk SOAR builds the database lookup using a supplied name instead of a bound SQL value, enabling full database read access and integrity compromise. ...

CVE-2026-76363 Structured Query Language Injection through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbo...

CVE-2026-76363

Splunk SOAR versions below 8.6.0 allow an "Automation Engineer" to inject arbitrary SQL via the playbook automation data REST API, enabling full read/write/delete of the database. Splunk advisory SVD-2026-0804 confirms the fix; no in-the-wild exploitation is reported. Upgrade to 8.6.0 or later.

CVE-2026-76349

CVE-2026-76349 is an SPL injection vulnerability in Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14 (not affecting 10.4+). The root cause is that Splunk Web substitutes form token values from URLs into SPL searches without neutralizing them , allowing an unauthenticated attacker to cr...

CVE-2026-76349 SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-76343

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the Data Orchestration jobs endpoint builds SQL queries from user-controlled job filter values without parameterized queries. A non-admin user can inject SQL, accessing all Data Orchestration data and stored credentials (CVSS...

CVE-2026-76339

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the geostats command fails to validate input, allowing a low-privileged user to inject arbitrary SPL that executes under another user's permissions after phishing. CVSS 5.4 (MEDIUM); no exploitation evidence provided. Upgrade to affec...

CVE-2026-76334 SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

CVE-2026-76334

CVE-2026-76334 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) affecting the Dashboard Studio component. A user holding the "power" role can store a workflow action containing attacker-controlled SPL. When another authenticated user selec...