Known vulnerabilities in Splunk Enterprise Security (ES)

Vendor: Splunk Inc.
Software: Splunk Enterprise Security (ES)
Software CPE: cpe:2.3:a:splunk:es:*:*:*:*:*:*:*:*
Website: https://www.splunk.com/
Total vulnerabilities: 17
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Splunk Enterprise Security (ES) Splunk Enterprise Security (ES) is affected by 17 known vulnerabilities: 2 high, 12 medium, 3 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144427 - Improper input validation
CVE-2026-76387		 CWE-20 Medium
No
No
 8.6.1 20.08.2026 SB2026082082
#VU144428 - Incorrect Permission Assignment for Critical Resource
CVE-2026-76388		 CWE-732 Medium
No
No
 8.6.1 20.08.2026 SB2026082082
#VU108091 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2025-25977		 CWE-1321 High
No
No
 7.3.4, 8.1.0 30.04.2025 SB2025043032
SB2025043033
SB2025073179
and 2 more
#VU99563 - Improper Verification of Cryptographic Signature
CVE-2024-48948		 CWE-347 Low
No
No
 8.1.0 31.10.2024 SB2024103162
SB2024103166
SB2024110115
and 18 more
#VU97606 - Improper Verification of Cryptographic Signature
CVE-2024-42459		 CWE-347 Medium
No
No
 8.1.0 19.09.2024 SB2024091934
SB2024091939
SB2024092062
and 23 more
#VU97605 - Improper Verification of Cryptographic Signature
CVE-2024-42460		 CWE-347 Medium
No
No
 8.1.0 19.09.2024 SB2024091934
SB2024091939
SB2024092062
and 24 more
#VU97604 - Improper Verification of Cryptographic Signature
CVE-2024-42461		 CWE-347 Medium
No
No
 8.1.0 19.09.2024 SB2024091934
SB2024091939
SB2024092062
and 24 more
#VU85200 - Resource Management Errors
CVE-2024-22165		 CWE-399 Low
No
No
 7.1.2, 7.2.0, 7.3.0 09.01.2024 SB2024010964
#VU85199 - Resource exhaustion
CVE-2024-22164		 CWE-400 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 09.01.2024 SB2024010964
#VU85172 - Incorrect Regular Expression
CVE-2021-23446		 CWE-185 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 09.01.2024 SB2021092928
SB2024010965
#VU83234 - Incorrect Comparison
CVE-2023-45133		 CWE-697 Low
No
No
 7.1.2, 7.2.0, 7.3.0 17.11.2023 SB2023111710
SB2023111712
SB2023113028
and 24 more
#VU78932 - Incorrect Regular Expression
CVE-2022-25883		 CWE-185 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 03.08.2023 SB2023080361
SB2023080362
SB2023081514
and 73 more
#VU71577 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-46175		 CWE-94 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 26.01.2023 SB2023012644
SB2023012645
SB2023013117
and 44 more
#VU70123 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-37601		 CWE-94 High
No
No
 7.1.2, 7.2.0, 7.3.0 12.12.2022 SB2022121220
SB2023010419
SB2023011403
and 20 more
#VU70122 - Incorrect Regular Expression
CVE-2022-37599		 CWE-185 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 12.12.2022 SB2022121221
SB2023010424
SB2023020920
and 19 more
#VU70121 - Incorrect Regular Expression
CVE-2022-37603		 CWE-185 Medium
No
No
 7.1.2, 7.2.0, 7.3.0 12.12.2022 SB2022121221
SB2022121222
SB2023010418
and 29 more
#VU66400 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2022-33987		 CWE-601 Medium
No
No
 8.1.0 11.08.2022 SB2022081124
SB2022081525
SB2022090835
and 22 more