Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4021–4040 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76344

Path Traversal through the Search Dispatch REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer (REST) API endpoint and affect system inte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:41.251Z. Updated 2026-08-26T15:21:00.823Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76343

Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestrat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4021 to 4040 of 12259.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:40.632Z. Updated 2026-08-26T15:21:10.540Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76342

Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language (SPL) commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user opens the dataset in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:40.021Z. Updated 2026-08-26T15:21:19.441Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76341

Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user opens the dataset in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:39.437Z. Updated 2026-08-26T15:21:25.159Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76340

Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:38.821Z. Updated 2026-08-26T15:21:31.648Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76339

SPL Injection through the geostats Command in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language (SPL) commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user ini…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:38.214Z. Updated 2026-08-26T15:21:39.989Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76338

Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible becau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:37.625Z. Updated 2026-08-27T16:24:58.778Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76337

Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:37.016Z. Updated 2026-08-26T15:21:49.476Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76336

Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete expo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:36.419Z. Updated 2026-08-26T15:21:55.211Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:21 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76335

Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Ent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:35.810Z. Updated 2026-08-27T16:24:58.589Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76334

SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and selects Continue, Spl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:35.225Z. Updated 2026-08-27T16:24:58.425Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76333

Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-contr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:34.638Z. Updated 2026-08-26T15:22:05.626Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76332

SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:34.043Z. Updated 2026-08-27T16:24:58.254Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76331

SPL Injection through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:33.443Z. Updated 2026-08-27T16:24:58.088Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76330

SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:32.855Z. Updated 2026-08-27T16:24:57.898Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76329

SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:32.243Z. Updated 2026-08-26T15:22:13.844Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76328

SPL Injection through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format (PDF) file, Splunk Enterprise runs the inj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:31.631Z. Updated 2026-08-27T16:24:57.720Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:24 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76327

SPL Injection through Splunk Web in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "sc_admin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator (URL). The resulting dashboa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:31.028Z. Updated 2026-08-26T15:22:21.208Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record

MedPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76326

Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:30.433Z. Updated 2026-08-26T15:22:29.114Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record

HighPublished 20 Aug 2026, 04:34 WIB

CVE-2026-76325

Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T21:34:29.789Z. Updated 2026-08-26T15:22:35.153Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 22:22 WIB

Official record