CVE-2026-76269

Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to an improper access control flaw in its REST API . The vulnerability occurs because the API fails to fully validate job ownership when processing a user-controlled job identifier. Consequently, a user without...

EUVD-2026-94621

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, jo...

CVE-2026-76269 Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, jo...

EUVD-2026-94619

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267 Log Injection through the REST API in Splunk App for Splunk O11y Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76267

In Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 , a log injection vulnerability exists within the Splunk App for Splunk O11y Cloud . An attacker with the read_o11y_content capability can inject forged entries into the application log via the REST API . This occurs because the ap...

CVE-2026-76265

Splunk Enterprise (versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15) and Splunk Secure Gateway (versions below 3.10.11, 3.9.25, and 3.8.72) are vulnerable to an improper access control flaw. The root cause is that multiple REST API endpoints in Splunk Secure Gateway fail to enforce authorizatio...

CVE-2026-76265 Improper Access Control through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

EUVD-2026-94617

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

CVE-2026-76264 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write path...

CVE-2026-76264

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15 are vulnerable to an improper authorization flaw via the REST API. An attacker with low-level privileges (not holding admin or power roles) can create or edit scripted lookup definitions using raw configuration endpoints. This i...

Exploit for Interpretation Conflict in Wordpress

wp2shell-PoC ⚠ This tool is created solely for education...

CVE-2026-107180

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180

On MISP instances where Security.otp_required is enabled, a logic flaw allows authenticated users to bypass mandatory TOTP enrolment . The enforcement mechanism only applied to standard browser requests; consequently, users could bypass the setup by issuing non-browser requests such as AJAX/XHR c...

CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

EUVD-2026-94318

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-107180 MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

On MISP instances configured to require TOTP enrolment Security.otprequired, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-104049

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...