CVE-2026-76389

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, the Talos enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data, enabling an SSRF attack. A user with the get_talos_enrichment capability can force the instanc...

CVE-2026-76383

In RSA SecurID Authentication Manager app for Splunk SOAR versions below 1.0.5, the enable_token and revoke_token actions expose the sensitive token_serial parameter in cleartext because it is not marked as a password-type parameter. A user with action-execution privileges can view the serial in ...

CVE-2026-76366

Splunk SOAR versions below 8.6.0 allow authenticated users to exploit REST API filtering on playbook runs to recover session tokens that would otherwise be hidden, enabling compromise of all data accessible to the affected account. CVSS 6.5 (MEDIUM). No in-the-wild exploitation reported. Splunk a...

CVE-2026-76351 Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

CVE-2026-76349

CVE-2026-76349 is an SPL injection vulnerability in Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14 (not affecting 10.4+). The root cause is that Splunk Web substitutes form token values from URLs into SPL searches without neutralizing them , allowing an unauthenticated attacker to cr...

CVE-2026-76349 SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-76340

Splunk Enterprise 10.4.x versions below 10.4.2 are affected by a missing authorization vulnerability in the REST API . The token-key reload endpoint does not require authentication or the change_authentication capability, allowing an unauthenticated attacker to force a reload of token-signing key...

CVE-2026-76338 Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

CVE-2026-76338

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are vulnerable because the distributed search token REST endpoint does not require a signed request, falling back to shared local key material. An attacker with a trusted distributed search private key can forge an admin session ...

CVE-2026-76310 Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

CVE-2026-76310

An unauthenticated user with an embedded report token can download the search job dispatch archive via REST API, recover session material, and access all data available to the report owner—including admin-level actions—due to embedded report access not blocking dispatch archive downloads. Affecte...

CVE-2026-76259

On Windows, a low-privileged local user can bind to Splunk's management port before the service starts, intercept authentication tokens from child processes, and escalate privileges to compromise all data and system integrity accessible to the Splunk service account. No in-the-wild exploitation i...

CVE-2026-76259 Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all...

CVE-2026-76258

Splunk Secure Gateway's companion app registration handler uses a hard-coded cryptographic key, allowing non-admin/power users to register arbitrary callback URLs and redirect mobile user tokens to attacker-controlled endpoints. Splunk fixed this in Secure Gateway 3.8.71, 3.9.24, and 3.10.10; Ent...

CVE-2026-76251

Splunk Enterprise versions before 10.0.9, 10.2.6, and 10.4.2 fail to enforce the read_o11y_content capability on the Splunk App for Splunk Observability Cloud REST API endpoints, allowing low-privilege users to forward requests using the stored access token, exposing Observability Cloud data (HIG...

CVE-2026-55088

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

EUVD-2026-62725

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-55088

In ep_etherpad-lite versions 2.6.0–3.0.0, the GET /tokenTransfer/{uuid} handler in tokenTransfer.ts has no expiration check, no single-use enforcement, and echoes the raw author token in the response body via res.send(tokenData). Any attacker who obtains a transfer UUID can repeatedly redeem it t...

CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...