Known vulnerabilities in Splunk Enterprise
Vendor:
Splunk Inc.
Software:
Splunk Enterprise
Software CPE:
cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*
Website:
https://www.splunk.com/
Total vulnerabilities:
472
Public exploits:
25
Known exploited (KEV):
5
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
9.3.14
9.4.13
10.0.8
10.2.5
10.4.1
9.3.13
9.4.12
10.2.4
10.0.7
10.4.0
9.3.12
9.4.11
10.0.6
10.2.3
9.3.11
9.4.10
10.0.5
10.2.2
9.3.10
9.4.9
10.0.4
10.2.1
9.2.11
9.4.7
9.2.12
9.3.9
9.4.8
10.0.3
10.2.0
9.2.10
9.3.8
9.4.6
10.0.2
9.4.5
9.3.7
9.2.9
9.2.8
9.3.6
9.4.4
10.0.1
10.0.0
9.4.3
9.3.5
9.2.7
9.1.10
9.4.2
9.3.4
9.2.6
9.1.9
9.4.1
9.3.3
9.2.5
9.1.8
9.4.0
9.3.2
9.2.4
9.1.7
9.3.1
9.2.3
9.1.6
9.0.10
9.1.5
9.2.2
9.3.0
9.2.1
9.1.4
9.0.9
9.2.0
9.1.3
9.0.8
9.1.2
9.0.7
9.1.1
9.0.6
8.2.12
9.1.0
9.0.5
8.2.11
8.1.14
7.1.1
9.0.4
8.2.10
8.1.13
9.0.3
9.0.2
8.2.9
8.1.12
8.2.8
8.2.7.1
8.1.11
9.0.1
9.0.0
8.2.7
8.2.6
8.2.5
8.2.4
8.2.3
8.2.2
8.2.1
8.2.0
8.1.10
8.1.9
8.1.8
8.1.7
8.1.6
8.1.5
8.1.4
8.1.3
8.1.2
8.1.1
8.1.0
8.0.10
8.0.9
8.0.8
8.0.7
8.0.6
8.0.5
8.0.4
8.0.3
8.0.2
8.0.1
8.0.0
7.3.9
7.3.8
7.3.7
7.3.6
7.3.5
7.3.4
7.3.3
7.3.2
7.3.1
7.3.0
7.2.10
7.2.9
7.2.8
7.2.7
7.2.6
7.2.5
7.2.4
7.2.3
7.2.2
7.2.1
7.2.0
7.0.0.1
6.1.14
6.0.15
5.0.19
5.0.0
6.1.0
6.0.0
6.3.0
6.2.14
6.2.0
7.0.1
6.3.12
6.4.9
6.5.6
6.6.4
6.6.3.2
6.3.11
6.4.8
6.4.7
6.5.5
6.5.4
6.5.3
7.0.0
6.6.3
6.6.2
6.6.1
6.6
6.5.2
6.5.1
6.5.0
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4.0
6.3.10
6.3.9
6.3.8
6.3.7
6.3.6
6.3.5
6.3.4
6.3.3
6.3.2
6.3.1
6.2.13
6.2.12
6.2.11
6.2.10
6.2.9
6.2.8
6.2.7
6.2.6
6.2.5
6.2.4
6.2.3
6.2.2
6.2.1
6.1.13
6.1.12
6.1.11
6.1.10
6.1.9
6.1.8
6.1.7
6.1.6
6.1.5
6.1.4
6.1.3
6.1.2
6.1.1
6.0.14
6.0.13
6.0.12
6.0.11
6.0.10
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
5.0.18
5.0.17
5.0.16
5.0.15
5.0.14
5.0.13
5.0.12
5.0.11
5.0.10
5.0.9
5.0.8
5.0.7
5.0.6
5.0.5
5.0.4
5.0.3
5.0.2
5.0.1
Vulnerabilities (472)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU138948 - Exposure of sensitive information to an unauthorized actor CVE-2026-20298 |
CWE-200 | Low | 9.4.13, 10.0.8, 10.2.5, 10.4.1 | 21.07.2026 |
SB20260721124 |
||
| #VU138947 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-20297 |
CWE-22 | Low | 9.3.14, 9.4.13, 10.0.8, 10.2.5, 10.4.1 | 21.07.2026 |
SB20260721124 |
||
| #VU138946 - Cross-Site Request Forgery (CSRF) CVE-2026-20296 |
CWE-352 | High | 9.4.13, 10.0.8, 10.2.5, 10.4.1 | 21.07.2026 |
SB20260721124 |
||
| #VU134465 - Improper Access Control CVE-2026-20259 |
CWE-284 | Low | 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134463 - Deserialization of Untrusted Data CVE-2026-20251 |
CWE-502 | Medium | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134462 - Server-Side Request Forgery (SSRF) CVE-2026-20252 |
CWE-918 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134461 - Missing Authentication for Critical Function CVE-2026-20253 |
CWE-306 | High | 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134460 - Improper input validation CVE-2026-20254 |
CWE-20 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134459 - Improper input validation CVE-2026-20255 |
CWE-20 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134458 - Improper input validation CVE-2026-20256 |
CWE-20 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134457 - Improper input validation CVE-2026-20257 |
CWE-20 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU134456 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-20258 |
CWE-79 | Low | 9.3.13, 9.4.12, 10.0.7, 10.2.4 | 12.06.2026 |
SB2026061256 |
||
| #VU132090 - Information Exposure Through Log Files CVE-2026-20239 |
CWE-532 | Low | 10.0.5, 10.2.2 | 21.05.2026 |
SB2026052156 |
||
| #VU132089 - Improper input validation CVE-2026-20240 |
CWE-20 | Low | 9.3.12, 9.4.11, 10.0.5, 10.2.2 | 21.05.2026 |
SB2026052156 |
||
| #VU129667 - NULL Pointer Dereference CVE-2026-27141 |
CWE-476 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 05.05.2026 |
SB2026050532 SB2026052154 SB2026070811 |
||
| #VU124084 - Loop with Unreachable Exit Condition ('Infinite Loop') CVE-2025-58190 |
CWE-835 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 17.03.2026 |
SB2026031752 SB2026031758 SB2026031759 and 4 more |
||
| #VU124083 - Resource exhaustion CVE-2025-47911 |
CWE-400 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 17.03.2026 |
SB2026031752 SB2026031758 SB2026031759 and 4 more |
||
| #VU123445 - Improper Control of Generation of Code ('Code Injection') CVE-2025-61732 |
CWE-94 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 03.03.2026 |
SB2026030334 SB2026030343 SB2026030375 and 25 more |
||
| #VU123129 - Improper Certificate Validation CVE-2025-68121 |
CWE-295 | High | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 23.02.2026 |
SB2026022333 SB2026030334 SB2026030343 and 112 more |
||
| #VU120232 - Uncontrolled Recursion CVE-2025-68156 |
CWE-674 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 22.12.2025 |
SB2025122249 SB2025122250 SB2025122251 and 12 more |
Showing elements 1 - 20 out of 472