CVE Vulnerability Catalog

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive.

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the URL of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission.

In Splunk SOAR versions below 8.7.0, a user with a role holding the install_apps capability can install an app containing attacker-controlled content in its documentation, which Splunk SOAR does not sanitize before display. When another user with permission to view apps opens the app documentation, that content is executed in their browser, potentially allowing the attacker to access data and make changes with the victim's privileges.

Cisco's internal security review discovered multiple vulnerabilities related to improper neutralization (CWE-707). Fixes were released as part of a software hardening update.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76301 relates to protection mechanism failure (CWE-693).

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76300 relates to improper control of a resource through its lifetime (CWE-664).

Cisco conducted an internal security review resulting in a software hardening release. The vulnerabilities tracked by this CVE relate to improper access control and are classified under CWE-284.

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user without the admin or power Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary OS commands as the account running Splunk Enterprise on search head cluster members. The flaw exists because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user holding the edit_federated_providers capability into turning off all federated search providers. This is possible because the federated provider REST API accepts GET requests for state-changing actions, and exploitation requires phishing the affected user.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user without the "admin" or "power" roles could view dashboard and report listings beyond the requested filter scope while remaining within accessible objects. The vulnerability exists because Splunk Secure Gateway does not neutralize special characters in values before creating filters.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access. The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the edit_manager_xml capability can execute arbitrary operating-system commands with the permissions of the account running Splunk Enterprise by opening the affected configuration in Splunk Web Manager. The vulnerability exists because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting expression syntax.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the REST API endpoint for lookup table files. The affected instance requires a restart to restore service because the endpoint does not limit resource use when it processes response field selections.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

In Splunk Enterprise versions below 10.4.4, a user holding a role with the preview_data_management_pipeline or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability exists because the Data Management REST API verifies the required capability but does not verify that the requested preview job belongs to the requester. The affected API is available only when the Edge Processor feature is enabled, which is off by default.

php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.