Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Splunk SOAR (On-premises) versions below 8.6.0 is reachable by any authenticated user regardless of role assignment, via a crafted file path submitted to the REST API. The REST API endpoint neither enforces role-based access control nor restricts the user-supplied path to the intended temporary directory, enabling path traversal (CWE-22) that culminates in code execution on the SOAR server. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low privilege barrier - any valid account, zero roles required - meaningfully elevates real-world risk in environments where SOAR accounts are broadly provisioned.
Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.
Stored cross-site scripting in Wekan's HTML board export function allows a board member - including one whose access has since been revoked - to inject JavaScript that executes when any recipient clicks a card in a downloaded HTML export file. Wekan versions 8.72 through 10.23 are affected; the exploit survives membership removal and is capable of exfiltrating all board data embedded in the export to an attacker-controlled endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Scope:Changed CVSS classification and post-revocation persistence make this more dangerous than its 7.6 score suggests.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.
Unauthenticated information disclosure in Splunk Enterprise 10.4.x exposes Prometheus service metrics from the Edge Processor SPL2 Preview sidecar to any network-reachable client. The sidecar's Prometheus metrics endpoint lacks authentication, allowing retrieval of runtime and build metadata without credentials. No public exploit code has been identified at time of analysis, and the vulnerability does not affect Splunk Enterprise versions below 10.4.
JWT bearer token leakage in the Grav API Plugin for Grav CMS (prior to 1.0.0-rc.16) exposes valid access tokens to any party with access to server logs, proxy logs, CDN logs, browser history, or Referer headers. The JwtAuthenticator::extractBearerToken() method accepted tokens supplied via the ?token= URL query parameter on every /api/v1 route - including state-changing endpoints - rather than restricting token-in-URL to the file-download routes where it is technically necessary. An attacker who obtains a token from those secondary log sources can replay it with the full API privileges of the original token owner. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote disclosure of Edge Processor pipeline configurations in Splunk Enterprise 10.4.x exposes potentially sensitive data-processing logic to any network-accessible attacker. The REST API endpoint serving Edge Processor configuration lacks authentication controls (CWE-306), meaning any unauthenticated actor can retrieve pipeline details when the Edge Processor feature is enabled. No public exploit code has been identified at time of analysis, and the flaw is restricted to the 10.4.x branch - prior versions are unaffected.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings without defensive identifier quoting. Operators using the Postgres backend in affected versions are directly impacted; the CVSS 4.0 vector (PR:H, AT:P) reflects that the current vulnerable code path requires operator-level control over schema configuration, though the unsafe pattern creates latent risk if schema names are ever derived from tenant or request input. No public exploit code exists and no CISA KEV listing has been identified; the vendor-released patch in 0.9.0a2 resolves the issue by adding identifier quoting and regression coverage.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized access to user chat data in Bottinelli Informatica Vedo Suite 1.2.5 is possible via an Insecure Direct Object Reference (IDOR) flaw in the api_vedo/chat REST endpoint, where the utente_chat parameter is not validated against the requester's session or authorization context. The 'Authentication Bypass' tag alongside a PR:N CVSS vector indicates the endpoint may be reachable without any valid credentials, making this a high-confidence confidentiality breach for any network-accessible deployment. No public exploit code has been confirmed in automated exploit frameworks, and the EPSS score of 0.24% (16th percentile) indicates limited observed exploitation at time of analysis, consistent with a low-prevalence niche product.
Improper access control in Splunk AI Toolkit versions below 6.0.0 allows an authenticated user holding the schedule_search capability to deserialize arbitrary model files by invoking the apply search command via a scheduled search. Because the toolkit does not designate apply as a risky command, Splunk's built-in risky-command access controls are never triggered, enabling privilege escalation beyond what the role should permit. A vendor-released patch exists (version 6.0.0); no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in RDK-B WebUI version rdkb-2025q4-kirkstone.04.10.26 is achievable by any remote unauthenticated attacker who submits an excessively large password value to the login handler, triggering uncontrolled resource consumption in the `check.jst` template. The flaw (CWE-400) requires no credentials, no user interaction, and no special configuration - any device with its WebUI reachable is vulnerable to availability loss. EPSS sits at 0.22% (13th percentile), and no active exploitation or public exploit code has been identified at time of analysis, keeping real-world urgency moderate despite the high CVSS base score.
Unauthenticated broken access control in the Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) allows remote unauthenticated attackers to modify plugin options, resulting in high integrity impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has permission before processing option-change requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a low-barrier, fully network-exploitable condition.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Unauthenticated account lockout in the User Verification by PickPlugins WordPress plugin (through version 2.0.47) enables remote attackers to reset the email-verification status of any WordPress account - including administrators - by exploiting two authorization failures simultaneously: the resend-verification endpoint neither validates that the requestor is authorized to act on the specified user ID, nor binds the protective token to the targeted user. This effectively provides a remote, zero-privilege mechanism to lock any site account out of access. No public exploit code exists at the time of analysis, though SSVC classifies the attack as automatable, meaning bulk account disruption campaigns are technically feasible.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a denial-of-service condition against the platform, with no confidentiality or integrity impact per Cisco's own CVSS assessment. An extremely broad range of versions from 1.x through 4.0.x are affected, spanning many years of releases, indicating this class of flaw was introduced early in the product lifecycle. No public exploit identified at time of analysis and no active exploitation confirmed; Cisco discovered these vulnerabilities internally during a proactive hardening review and issued a software hardening release.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Non-constant-time password hash comparison in Relay's authentication layer exposes a timing side-channel that allows credential inference via statistical analysis of response latencies. Attackers who can issue repeated authentication requests and measure response timing with sufficient precision can progressively reconstruct valid hashes or credentials byte-by-byte. No KEV listing exists and no public exploit has been identified at time of analysis, though timing oracle attacks of this class are well-understood with established methodology and tooling.
Authentication bypass in IBM System Storage DS8A00 (firmware 10.1.3.0-10.11.35.0) and DS8900F (firmware 89.40.83.0-89.44.25.0) exposes enterprise storage array management interfaces to network-reachable attackers who can circumvent security controls without valid credentials, enabling exfiltration of sensitive management data or availability disruption. The root cause is CWE-116 (Improper Encoding or Escaping of Output) in DSCLI command output processing, where encoding defects allow authentication logic to be bypassed. No public exploit code has been identified at time of analysis, and a vendor patch is available via IBM's security advisory.
Stored XSS in HumHub Community Edition 1.18.4 and 1.18.4-pl1 allows authenticated low-privilege users to inject arbitrary HTML and JavaScript into the oEmbed confirmation prompt rendered for other users. The attacker-controlled URL prefix was passed unencoded into the HTML consent dialog via Html::tag() in UrlOembed.php, and a secondary code path flaw allowed confirmation content to flow through a CSP nonce injection routine - meaning embedded markup could acquire a valid nonce and bypass Content Security Policy. No public exploit identified at time of analysis, though Fluid Attacks has published a coordinated disclosure advisory with proof-of-concept detail.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability stems from improper neutralization of special elements passed to OS commands (CWE-78), resulting in full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the vendor self-disclosed this via Dell Security Advisory DSA-2026-096, indicating a confirmed code-level flaw.
Certificate validation bypass in Splunk Connect for Kafka below version 2.2.7 allows a network-positioned unauthenticated attacker to intercept and modify event data in transit to Splunk Enterprise's HTTP Event Collector when Kerberos authentication is configured. The Kerberos code path fails to apply the connector's configured TLS certificate validation options when constructing the HTTP client, effectively negating transport security despite HEC's TLS configuration. No active exploitation has been identified (not in CISA KEV), but the confidentiality and integrity impact on Splunk-ingested telemetry data is high.
Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interception and tampering by a network-positioned attacker. Versions below 8.6.0 are affected when a CyberArk REST credential manager integration is configured; the client accepts any server certificate without verification, making TLS sessions transparent to a man-in-the-middle. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, but the high confidentiality and integrity impact on privileged credential data warrants priority remediation in environments relying on CyberArk for SOAR playbook secrets.
FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated SPL injection in Splunk Enterprise's nearby-event search feature allows remote attackers to execute arbitrary Search Processing Language queries without authorization across versions 9.4.x, 10.0.x, 10.2.x, and 10.4.x. The root cause is a two-pronged failure: Splunk Web does not consistently escape caller-supplied values when constructing SPL for nearby-event searches, and the embedded report access endpoint accepts those crafted requests without performing the expected authorization check. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and wide enterprise deployment of Splunk make this a priority patch.
Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.3 rating and high confidentiality and integrity impact scores reflect meaningful lateral risk within an enterprise's Splunk deployment.