Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4001–4020 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76364

Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:53.480Z. Updated 2026-08-21T03:55:54.763Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:55 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76363

Structured Query Language Injection through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data AP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4001 to 4020 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:52.901Z. Updated 2026-08-21T03:55:53.553Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:55 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76362

Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:52.296Z. Updated 2026-08-21T03:56:04.383Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:56 WIB

Official record

LowPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76361

Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request For…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:51.669Z. Updated 2026-08-20T16:27:34.354Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76360

Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:51.070Z. Updated 2026-08-20T16:27:34.503Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76359

Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder credentials-package extraction workflo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:50.450Z. Updated 2026-08-20T16:27:34.656Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76358

Path Traversal through App Installation Tar Extraction in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:49.819Z. Updated 2026-08-20T16:27:34.807Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76357

Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:49.197Z. Updated 2026-08-20T16:27:34.967Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76356

Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:48.572Z. Updated 2026-08-27T16:24:58.958Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76355

Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:47.950Z. Updated 2026-08-26T15:20:53.488Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:20 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76354

Path Traversal through Search Head Clustering in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:47.365Z. Updated 2026-08-20T16:27:35.131Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76353

Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and disrupt service. The v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:46.696Z. Updated 2026-08-20T16:27:35.287Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76352

Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, whi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:46.069Z. Updated 2026-08-21T03:56:08.865Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:56 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76351

Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:45.483Z. Updated 2026-08-21T03:56:18.924Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:56 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76350

Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:44.885Z. Updated 2026-08-21T03:56:20.072Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 10:56 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76349

SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language (SPL) commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access all relevant data. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:44.280Z. Updated 2026-08-20T16:27:35.904Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

LowPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76348

Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:43.675Z. Updated 2026-08-20T16:27:36.062Z.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76347

Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:43.078Z. Updated 2026-08-20T16:27:36.214Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76346

Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds the "admin" Splunk rol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:42.479Z. Updated 2026-08-20T16:27:36.363Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76345

Remote Code Execution (RCE) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer (REST) API to write files to locations that the user account running Splunk Enterprise can write to, which could all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:41.863Z. Updated 2026-08-20T16:27:36.514Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 23:27 WIB

Official record