CVE-2026-107229

The AsyncHttpClient (AHC) library for Java applications contains a vulnerability in the ThreadSafeCookieStore component. From version 2.16.0 until 3.0.14 , the library incompletely validates cookie Domain attributes due to missing private-section and public-suffix rules, lack of A-label normaliza...

CVE-2026-107228

The AsyncHttpClient (AHC) library versions 2.1.0 through 3.0.14 contains a vulnerability where the default cookie store silently overrides explicit Cookie headers provided via setHeader or addHeader. In shared client environments, this allows cookies from one user's session to replace another use...

CVE-2026-107227

The AsyncHttpClient (AHC) library is vulnerable to a denial of service (DoS) attack via a decompression bomb when WebSocket permessage-deflate decompression is enabled. In versions 2.2.0 until 3.0.14 , the inbound pipeline aggregates compressed frames before inflation, meaning webSocketMaxFrameSi...

CVE-2026-76286

The Splunk MCP Server is vulnerable to a Server-Side Request Forgery (SSRF) in versions below 1.2.1 . A user with the mcp_tool_execute capability can be induced to run a custom API tool configured by another user. This flaw allows the server to send the executing user's Splunk platform authentica...

CVE-2026-76285

Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3 , 10.2.7 , 10.0.10 , and 9.4.15 . The vulnerability is classified as Improper Adherence to Coding Standards (CWE-710 ). While the primary CVE description is general, related vulnerabilities in the...

CVE-2026-76284

Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 . These issues involve Improper Neutralization (CWE-707) and are grouped by Common Weakness Enumeration, with CVE-2026-76284 assigned to one of these groups. Specific ...

CVE-2026-76283

Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3 , 10.2.7 , 10.0.10 , and 9.4.15 . The issue is categorized as a Protection Mechanism Failure (CWE-693). While the specific root cause for this CVE is not detailed in the provided documents beyond ...

CVE-2026-76282

Splunk Enterprise versions 10.4.3 , 10.2.7 , 10.0.10 , and 9.4.15 are affected by CVE-2026-76282 , which involves Improper Control of a Resource Through its Lifetime (CWE-664). Splunk addressed these internally identified vulnerabilities by grouping them by CWE and assigning specific identifiers ...

CVE-2026-76281

Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are affected by an improper access control vulnerability (CWE-284). Splunk internally identified these issues and addressed them in the mentioned versions. Specific technical details regarding the root cause or component are not provi...

CVE-2026-76280

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are vulnerable to an incorrect permission assignment in App Key Value Store (KV Store) collections. An authenticated user without "admin" or "sc_admin" roles ...

CVE-2026-76278

Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an authorization bypass in the SPL2 module permissions. A user with the edit_spl2_module_permissions capability can use the affected REST API to access permission grants for SPL2 modules they are not authorized to view...

CVE-2026-76279

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to an improper input validation flaw in the collect Search Processing Language (SPL) command. The root cause is that the system fails to normalize whitespace in index names before enforcing role-based index-access...

CVE-2026-76276

Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an information disclosure flaw in the Discover Splunk Observability Cloud app via Splunk Web. A low-privileged user lacking "admin" or "power" roles can retrieve the app's original source code because production JavaSc...

CVE-2026-76277

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to improper input validation when creating native Splunk usernames via the REST API . A user with the edit_user capability can create a username ending in a trailing period because the system fails to reject it be...

CVE-2026-76274

Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the Splunk App for Splunk Observability Cloud . An attacker with a role possessing the read_o11y_content capability can exploit the REST API to redirect outbound requests t...

CVE-2026-76275

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 , an improper authorization vulnerability exists in the REST API . Users lacking "admin" or "power" roles can access search query text and job metadata—including job identifiers, dispatch parameters, result counts, and execut...

CVE-2026-76273

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to improper input validation via the collect Search Processing Language (SPL) command. An attacker with the run_collect capability can exploit the fact that the command fails to validate the index name before proc...

CVE-2026-76272

Splunk Enterprise and Splunk Secure Gateway are vulnerable to an access control flaw via the REST API. In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 , users without "admin" or "power" roles can trigger the gateway to sign attacker-controlled payloads because the system f...

CVE-2026-76270

Splunk Enterprise and Splunk Cloud Platform versions below 10.4.3 (excluding 10.2.x, 10.0.x, and 9.4.x) are vulnerable to an SQL Injection in the SPL2 module filtering functionality. A user with the list_spl2_modules capability can exploit the lack of parameterized user-supplied values in databas...

CVE-2026-76271

The Discover Splunk Observability Cloud app for Splunk Enterprise is vulnerable to a Denial of Service (DoS) condition in versions below 10.4.3 , 10.2.7 , and 10.0.10 (note: 9.4.x is not affected). A low-privileged user without "admin" or "power" roles can exploit the issue by submitting input to...