CVE-2026-76332 SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

CVE-2026-76333

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is insufficient URL validation in Dashboard Studio workflow actions. A user holding the "power" role can store a crafted URL in a workflow ac...

CVE-2026-76330 SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language SP...

CVE-2026-76327

CVE-2026-76327 is an SPL injection vulnerability in Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (below 3.10.9, 3.9.23, 3.8.70). The root cause is that Secure Gateway dashboards fail to neutralize caller-supplied values before embedding them in dashboard sear...

CVE-2026-76323 SPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

CVE-2026-76323

CVE-2026-76323 is an SPL risky command safeguards bypass in the Job Details dashboard of Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that the dashboard does not correctly neutralize a caller-supplied search identifier before embedding it into SPL search...

CVE-2026-76322

CVE-2026-76322 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 ) affecting the Dashboard Studio component. A user holding the "user" role can craft a dashboard that executes attacker-controlled Search Processing Language (SPL) in the conte...

CVE-2026-76322 SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76254

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14 are affected. Dataset Explorer fails to validate or escape dataset names when building SPL searches and skips SPL safeguards for risky commands, enabling a phishing attack to execute arbitrary SPL under the victim's privi...

CVE-2026-76255

Splunk Enterprise versions below 9.4.13, 10.0.8, 10.2.6, and 10.4.1 are vulnerable: Splunk Web omits SPL safeguards in the Data Model Editor's base search, allowing a low-privilege user to phish another into executing arbitrary SPL commands with the victim's privileges, compromising confidentiali...

CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

CVE-2026-76252

Splunk Web fails to validate origin/source of messages in its page message handler, enabling unauthenticated attackers to execute JavaScript in victims' browsers via phishing. Affected versions are below 9.4.13, 10.0.9, 10.2.6, and 10.4.2; CVSS 6.8 (Medium) requires user interaction. No public ex...

EUVD-2026-62532

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654

CVE-2026-53654 affects the Grav file-based web platform's Login plugin (prior to 3.8.5 ). The twofa_cancel task accepts a client-controlled _redirect field without a nonce, allowing an unauthenticated attacker to set an external http, https, or protocol-relative Location target. The root cause li...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-60883

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h 2026-08-19 17:52:19+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool RAT families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT,...

Phishing 3.0: The Fight Moves to Agent Versus Agent

Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message's intent, and it is failing now that the...