CVE-2026-76279: Improper Input Validation

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to write events to internal indexes outside the index access configured for the role. The vulnerability is...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...