EUVD-2026-62906

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

CVE-2026-76255

Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13 are affected. Splunk Web fails to enforce SPL risky-command safeguards in the Data Model Editor's base search, enabling a low-privilege user to phish a victim into executing arbitrary SPL with the victim's privileges. CVSS 6.4 ME...