Known vulnerabilities in Splunk Universal Forwarder
Vendor:
Splunk Inc.
Software:
Splunk Universal Forwarder
Software CPE:
cpe:2.3:a:splunk:splunk_universal_forwarder:*:*:*:*:*:*:*:*
Website:
https://www.splunk.com/
Total vulnerabilities:
97
Public exploits:
7
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
9.4.14
10.0.9
10.2.6
10.4.2
9.4.13
9.4.12
10.0.8
10.0.7
10.2.5
10.2.4
10.4.1
10.4.0
10.2.2
10.0.5
9.3.12
9.4.11
10.0.6
10.2.3
9.3.11
9.4.10
9.3.10
9.4.9
10.0.4
10.2.1
10.2.0
9.4.7
9.2.11
9.2.12
9.3.9
9.4.8
10.0.3
10.0.2
9.4.6
9.3.8
9.2.10
9.4.4
9.3.6
9.2.8
9.2.9
9.3.7
9.4.5
10.0.0
10.0.1
9.1.10
9.2.7
9.3.5
9.4.3
1.0.2
9.4.2
9.3.4
9.2.6
9.1.9
1.0.1
9.4.1
9.3.3
9.2.5
9.1.8
1.0.0
9.4.0
9.3.2
9.2.4
9.1.7
9.3.1
9.2.3
9.1.6
9.3.0
9.2.2
9.1.5
9.0.10
9.2.1
9.1.4
9.0.9
9.2.0
9.1.3
9.0.8
9.1.2
9.0.7
9.1.1
9.0.6
8.2.12
9.1.0
9.0.5
9.0.4
9.0.3
9.0.2
9.0.0
8.2.11
8.2.10
8.2.9
8.2.8
8.2.7
8.2.6
8.2.5
8.2.4
8.2.3.1
8.2.3
8.2.2
8.2.1
8.2.0
8.1.14
8.1.13
8.1.12
8.1.10
8.1.9
8.1.8
8.1.7
8.1.6
8.1.5
8.1.4
8.1.3
8.1.2
8.1.1
8.1.0
8.0.10
8.0.9
8.0.8
8.0.7
8.0.6
8.0.5
8.0.4
8.0.3
8.0.2
8.0.1
8.0.0
7.3.9
7.3.8
7.3.7
7.3.6
7.3.5
7.3.4
7.3.3
7.3.2
7.3.1
7.3.0
7.2.10
7.2.9
7.2.8
7.2.7
7.2.6
7.2.5
7.2.4
7.2.3
7.2.2
7.2.1
7.2.0
7.1.10
7.1.9
7.1.8
7.1.7
7.1.6
7.1.5
7.1.4
7.1.3
7.1.2
7.1.1
7.1.0
7.0.13
7.0.11
7.0.10
7.0.9
7.0.8
7.0.7
7.0.6
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
8.1.11
8.2.7.1
9.0.1
6.1.3
6.1.2
6.1.1
6.1.0
Vulnerabilities (97)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU125562 - Unchecked Return Value CVE-2026-31790 |
CWE-252 | Medium | 9.4.14, 10.0.9, 10.2.6, 10.4.2 | 09.04.2026 |
SB2026040943 SB2026040944 SB2026040945 and 27 more |
||
| #VU125565 - NULL Pointer Dereference CVE-2026-28388 |
CWE-476 | Low | 9.4.13, 9.4.14, 10.0.8, 10.0.9, 10.2.5, 10.2.6, 10.4.1, 10.4.2 | 09.04.2026 |
SB2026040943 SB2026040944 SB2026040945 and 39 more |
||
| #VU125566 - NULL Pointer Dereference CVE-2026-28389 |
CWE-476 | Medium | 9.4.13, 9.4.14, 10.0.8, 10.0.9, 10.2.5, 10.2.6, 10.4.1, 10.4.2 | 09.04.2026 |
SB2026040943 SB2026040944 SB2026040945 and 32 more |
||
| #VU125567 - NULL Pointer Dereference CVE-2026-28390 |
CWE-476 | Medium | 9.4.13, 9.4.14, 10.0.8, 10.0.9, 10.2.5, 10.2.6, 10.4.1, 10.4.2 | 09.04.2026 |
SB2026040943 SB2026040944 SB2026040992 and 49 more |
||
| #VU125568 - Heap-based Buffer Overflow CVE-2026-31789 |
CWE-122 | Medium | 9.4.14, 10.0.9, 10.2.6, 10.4.2 | 09.04.2026 |
SB2026040943 SB2026040944 SB2026040945 and 23 more |
||
| #VU122086 - Type confusion CVE-2026-22796 |
CWE-843 | Medium | 9.3.11, 9.4.10, 10.0.4, 10.2.1 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 51 more |
||
| #VU122085 - NULL Pointer Dereference CVE-2026-22795 |
CWE-476 | Medium | 10.0.4, 10.2.1 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 48 more |
||
| #VU122076 - Stack-based buffer overflow CVE-2025-15467 |
CWE-121 | High | 10.0.4, 10.2.1 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 66 more |
||
| #VU119138 - Incorrect Permission Assignment for Critical Resource CVE-2025-20387 |
CWE-732 | Low | 9.2.10, 9.3.8, 9.4.6, 10.0.2 | 04.12.2025 |
SB2025120434 |
||
| #VU116213 - Out-of-bounds write CVE-2025-9230 |
CWE-787 | Medium | 9.2.12, 9.3.9, 9.4.8, 10.0.3 | 01.10.2025 |
SB2025100119 SB2025100132 SB2025100133 and 108 more |
||
| #VU113118 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-27210 |
CWE-22 | Low | 9.2.12, 9.3.9, 9.4.8, 10.0.3 | 22.07.2025 |
SB2025072233 SB2025082103 SB2025091525 and 6 more |
||
| #VU110074 - Incorrect Default Permissions CVE-2025-20298 |
CWE-276 | Low | 9.1.9, 9.2.6, 9.3.4, 9.4.2 | 02.06.2025 |
SB2025060247 |
||
| #VU109241 - Error Handling CVE-2025-23166 |
CWE-388 | Medium | 9.2.12, 9.3.9, 9.4.8, 10.0.3 | 16.05.2025 |
SB2025051605 SB2025051901 SB2025051902 and 28 more |
||
| #VU103600 - Covert Timing Channel CVE-2024-13176 |
CWE-385 | Medium | 9.1.10, 9.2.7, 9.3.5, 9.4.3 | 04.02.2025 |
SB2025020454 SB2025020456 SB2025020656 and 58 more |
||
| #VU102736 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2024-12088 |
CWE-22 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 14.01.2025 |
SB2025011495 SB2025011504 SB2025011530 and 65 more |
||
| #VU102734 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2024-12087 |
CWE-22 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 14.01.2025 |
SB2025011495 SB2025011504 SB2025011530 and 74 more |
||
| #VU102732 - Exposure of sensitive information to an unauthorized actor CVE-2024-12086 |
CWE-200 | Medium | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 14.01.2025 |
SB2025011495 SB2025011504 SB2025011530 and 37 more |
||
| #VU102729 - Heap-based Buffer Overflow CVE-2024-12084 |
CWE-122 | Critical | 9.3.12, 9.4.11, 10.0.6, 10.2.3 | 14.01.2025 |
SB2025011495 SB2025011504 SB2025011530 and 25 more |
||
| #VU98757 - Out-of-bounds write CVE-2024-9143 |
CWE-787 | Low | 9.1.10, 9.2.7, 9.3.5, 9.4.3 | 16.10.2024 |
SB20241016108 SB2024102219 SB2024102417 and 58 more |
||
| #VU87538 - Resource exhaustion CVE-2024-28180 |
CWE-400 | Medium | 9.1.9, 9.2.6, 9.3.4, 9.4.2 | 14.03.2024 |
SB2024031446 SB2024031447 SB2024031448 and 106 more |
Showing elements 1 - 20 out of 97