CVE Vulnerability Catalog

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76300 relates to improper control of a resource through its lifetime (CWE-664).

Cisco conducted an internal security review resulting in a software hardening release. The vulnerabilities tracked by this CVE relate to improper access control and are classified under CWE-284.

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user without the admin or power Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary OS commands as the account running Splunk Enterprise on search head cluster members. The flaw exists because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user holding the edit_federated_providers capability into turning off all federated search providers. This is possible because the federated provider REST API accepts GET requests for state-changing actions, and exploitation requires phishing the affected user.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user without the "admin" or "power" roles could view dashboard and report listings beyond the requested filter scope while remaining within accessible objects. The vulnerability exists because Splunk Secure Gateway does not neutralize special characters in values before creating filters.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access. The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the edit_manager_xml capability can execute arbitrary operating-system commands with the permissions of the account running Splunk Enterprise by opening the affected configuration in Splunk Web Manager. The vulnerability exists because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting expression syntax.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the REST API endpoint for lookup table files. The affected instance requires a restart to restore service because the endpoint does not limit resource use when it processes response field selections.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

In Splunk Enterprise versions below 10.4.4, a user holding a role with the preview_data_management_pipeline or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability exists because the Data Management REST API verifies the required capability but does not verify that the requested preview job belongs to the requester. The affected API is available only when the Edge Processor feature is enabled, which is off by default.

php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.

php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 lack authentication in the enrollment status handler (GET /enroll/status). An unauthenticated remote attacker can retrieve an approved peer's signed Biscuit identity token by supplying a peer_id from the unauthenticated GET /info endpoint, then replay it as a bearer credential to read authorization policies and overwrite router multiaddrs.

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.