By year
10
12
13
14
15
17
18
19
20
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Splunk flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical FunctionExploited since Jun 18, 2026 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.9 · Oct 21, 2026
- CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.High 8.8 · Oct 21, 2026
- CVE-2026-76526 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.High 8.8 · Oct 21, 2026
- CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API High 7.2 · Oct 21, 2026
- CVE-2026-76306 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer passHigh 7.5 · Oct 21, 2026
- CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.9 · Oct 21, 2026
- CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.8 · Oct 21, 2026
- CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.High 8.8 · Oct 21, 2026
- CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.9 · Oct 21, 2026
- CVE-2026-76298 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar databaseHigh 8.8 · Oct 21, 2026
- CVE-2026-76293 In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary oHigh 7.2 · Oct 21, 2026
- CVE-2026-76291 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected High 8.8 · Oct 21, 2026
- CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endHigh 7.5 · Oct 21, 2026
- CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScripHigh 7.5 · Oct 21, 2026
- CVE-2026-76285 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.8 · Oct 7, 2026
- CVE-2026-76284 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.Critical 9.8 · Oct 7, 2026
- CVE-2026-76283 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.High 7.6 · Oct 7, 2026
- CVE-2026-76282 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.High 8.8 · Oct 7, 2026
- CVE-2026-76268 In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) ApplicaCritical 9.8 · Oct 7, 2026
- CVE-2026-76266 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk EnterprisHigh 7.7 · Oct 7, 2026
- CVE-2026-76404 In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system.Critical 9.1 · Aug 19, 2026
- CVE-2026-76403 In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the conHigh 7.4 · Aug 19, 2026
- CVE-2026-76402 In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could confiHigh 8.2 · Aug 19, 2026
- CVE-2026-76399 In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search ProcessHigh 8.1 · Aug 19, 2026
- CVE-2026-76397 In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including dHigh 8.1 · Aug 19, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.