CVE-2026-58439

A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...

kernel: smb/client: handle overlapping allocated ranges in fallocate

A flaw was found in the Linux kernel's Server Message Block SMB client. The smb3simplefallocaterange function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to...

kernel: smb/client: handle overlapping allocated ranges in fallocate

A flaw was found in the Linux kernel's Server Message Block SMB client. The smb3simplefallocaterange function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to...

kernel: smb/client: handle overlapping allocated ranges in fallocate

A flaw was found in the Linux kernel's Server Message Block SMB client. The smb3simplefallocaterange function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to...

EUVD-2026-62954

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the gettalosenrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer REST API endpoint and cause the instance to make an...

EUVD-2026-62919

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

EUVD-2026-62929

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database...

EUVD-2026-62917

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

EUVD-2026-63118

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

Oracle Linux 10 : yggdrasil (ELSA-2026-57126)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57126 advisory. 0.4.9.2-2 - Rebuild yggdrasil against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

GLSA-202608-20 : acl, attr: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-20 acl, attr: Multiple vulnerabilities Multiple vulnerabilities have been discovered in acl and attr. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

CVE-2026-76364

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database...

CVE-2026-76352

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running...

CVE-2026-76353

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76331

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

CVE-2026-76316

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

CVE-2026-76311

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

CVE-2026-76312

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language HTML source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerabilit...

CVE-2026-76399 Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-76391

In Splunk AI Toolkit versions below 6.0.0, the Agent Run History handler swaps the caller's session key for a system token, allowing low-privilege users to run system-level searches, access all data, and read or delete other users' search jobs. CVSS 3.1 scores 8.3 (HIGH). No exploitation evidence...