Splunk Cloud Platform vulnerabilities

• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise CVE-2026-20298 5.3 MediumJuly 15, 2026
• splunk, splunk cloud platform, enterprise +2 more SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise CVE-2026-20296 8.3 HighJuly 15, 2026
• splunk, splunk cloud platform, enterprise +2 more Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise CVE-2026-20297 7.2 HighJuly 15, 2026
• splunk, splunk cloud platform, enterprise +2 more Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise CVE-2026-20258 7.1 HighJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise CVE-2026-20252 7.6 HighJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise CVE-2026-20257 5.7 MediumJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Access Control in Splunk Enterprise CVE-2026-20259 5.5 MediumJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Input Validation through Classic Dashboards in Splunk Enterprise CVE-2026-20255 5.7 MediumJune 10, 2026
• splunk, splunk cloud platform, enterprise +1 more +3 more Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway CVE-2026-20251 Public exploit EPSS 30.6% 8.8 HighJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Information Disclosure through External Content Restriction Bypass in Splunk Enterprise CVE-2026-20254 5.7 MediumJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise CVE-2026-20256 5.7 MediumJune 10, 2026
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure through Log Files in Splunk Enterprise CVE-2026-20239 7.5 HighMay 20, 2026
• splunk, splunk cloud platform, enterprise +2 more Denial of Service through coldToFrozen.sh Script in Splunk Enterprise CVE-2026-20240 7.1 HighMay 20, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Access Control in Data Model Acceleration in Splunk Enterprise CVE-2026-20203 4.3 MediumApril 15, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise CVE-2026-20204 7.1 HighApril 15, 2026
• splunk, splunk cloud platform, enterprise +2 more Improper Input Validation during User Account Creation in Splunk Enterprise CVE-2026-20202 6.6 MediumApril 15, 2026
• splunk, splunk cloud platform, enterprise +2 more Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise CVE-2026-20163 8.0 HighMarch 11, 2026
• splunk, splunk cloud platform, enterprise +2 more Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise CVE-2026-20162 6.3 MediumMarch 11, 2026
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise CVE-2026-20166 5.4 MediumMarch 11, 2026
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise CVE-2026-20164 6.5 MediumMarch 11, 2026
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise CVE-2026-20165 6.3 MediumMarch 11, 2026
• splunk, splunk cloud platform, enterprise +2 more Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise CVE-2026-20139 4.3 MediumFebruary 18, 2026
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise CVE-2026-20144 6.8 MediumFebruary 18, 2026
• splunk, splunk cloud platform, enterprise +2 more Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise CVE-2026-20137 3.5 LowFebruary 18, 2026
• splunk, splunk cloud platform, enterprise +2 more Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise CVE-2025-20388 2.7 LowDecember 3, 2025
• splunk, splunk cloud platform, enterprise +1 more +3 more Improper Input Validation in "label" column field in Splunk Secure Gateway App CVE-2025-20389 4.3 MediumDecember 3, 2025
• splunk, splunk cloud platform, enterprise +1 more +3 more Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app CVE-2025-20383 4.3 MediumDecember 3, 2025
• splunk, splunk cloud platform, enterprise +2 more Unauthenticated Log Injection in Splunk Enterprise CVE-2025-20384 Public exploit 5.3 MediumDecember 3, 2025
• splunk, splunk cloud platform, enterprise +2 more Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise CVE-2025-20385 2.4 LowDecember 3, 2025
• splunk, splunk cloud platform, enterprise +2 more URL validation bypass through Views Dashboard in Splunk Enterprise CVE-2025-20382 3.5 LowDecember 3, 2025
• splunk, splunk cloud platform, enterprise +2 more Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise CVE-2025-20379 3.5 LowNovember 12, 2025
• splunk, splunk cloud platform, enterprise +2 more Open Redirect on Web Login endpoint in Splunk Enterprise CVE-2025-20378 3.1 LowNovember 12, 2025
• splunk, splunk cloud platform, enterprise +2 more Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise CVE-2025-20368 5.7 MediumOctober 1, 2025
• splunk, splunk cloud platform, enterprise +2 more Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise CVE-2025-20371 7.5 HighOctober 1, 2025
• splunk, splunk cloud platform, enterprise +2 more Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise CVE-2025-20367 5.7 MediumOctober 1, 2025
• splunk, splunk enterprise, cloud platform +1 more +3 more Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise CVE-2025-20370 4.9 MediumOctober 1, 2025
• splunk, splunk cloud platform, enterprise +2 more Improper Access Control in Background Job Submission in Splunk Enterprise CVE-2025-20366 6.5 MediumOctober 1, 2025
• splunk, splunk cloud platform, enterprise +2 more Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise CVE-2025-20369 4.6 MediumOctober 1, 2025
• splunk, splunk enterprise, cloud platform +1 more +3 more Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise CVE-2025-20322 4.3 MediumJuly 7, 2025
• splunk, splunk enterprise, cloud platform +1 more +3 more Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise CVE-2025-20321 6.5 MediumJuly 7, 2025
• splunk, splunk cloud platform, enterprise +2 more Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise CVE-2025-20325 3.1 LowJuly 7, 2025
• splunk, splunk enterprise, cloud platform +1 more +3 more Improper Access Control in System Source Types Configuration in Splunk Enterprise CVE-2025-20324 5.4 MediumJuly 7, 2025
• splunk, splunk enterprise, cloud platform +1 more +3 more Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise CVE-2025-20320 6.3 MediumJuly 7, 2025
• splunk, splunk cloud platform, enterprise +2 more Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise CVE-2025-20300 4.3 MediumJuly 7, 2025
• splunk, splunk cloud platform, enterprise +2 more Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component CVE-2025-20297 EPSS 31.2% 4.3 MediumJune 2, 2025
• splunk, splunk cloud platform, enterprise +2 more Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise CVE-2025-20232 5.7 MediumMarch 26, 2025
• splunk, splunk cloud platform, enterprise +2 more Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise CVE-2025-20229 EPSS 16.0% 8.0 HighMarch 26, 2025
• splunk, splunk cloud platform, enterprise +2 more Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise CVE-2025-20228 6.5 MediumMarch 26, 2025
• splunk, splunk cloud platform, enterprise +2 more Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio CVE-2025-20227 4.3 MediumMarch 26, 2025
• splunk, splunk cloud platform, enterprise +2 more Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise CVE-2025-20226 5.7 MediumMarch 26, 2025
• Show olderLoading…