What’s Vulnerable › Products
Splunk Cloud Platform vulnerabilities
109 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 50 published in the last 12 months.
Check whether your Splunk Cloud Platform version is affected
Latest Splunk Cloud Platform vulnerabilities
- CVE-2026-20298 — Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise (CVSS 6.5)
- CVE-2026-20297 — Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise (CVSS 7.2)
- CVE-2026-20296 — SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise (CVSS 8.3)
- CVE-2026-20259 — Improper Access Control in Splunk Enterprise (CVSS 5.5)
- CVE-2026-20258 — Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise (CVSS 5.4)
- CVE-2026-20257 — Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise (CVSS 5.7)
- CVE-2026-20256 — Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise (CVSS 5.7)
- CVE-2026-20255 — Improper Input Validation through Classic Dashboards in Splunk Enterprise (CVSS 5.7)
- CVE-2026-20254 — Information Disclosure through External Content Restriction Bypass in Splunk Enterprise (CVSS 5.7)
- CVE-2026-20252 — Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise (CVSS 7.6)
- CVE-2026-20251 — Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway (CVSS 8.8)
- CVE-2026-20240 — Denial of Service through coldToFrozen.sh Script in Splunk Enterprise (CVSS 6.5)
- CVE-2026-20239 — Sensitive Information Disclosure through Log Files in Splunk Enterprise (CVSS 6.5)
- CVE-2026-20204 — Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise (CVSS 7.1)
- CVE-2026-20203 — Improper Access Control in Data Model Acceleration in Splunk Enterprise (CVSS 4.3)
- CVE-2026-20202 — Improper Input Validation during User Account Creation in Splunk Enterprise (CVSS 6.6)
- CVE-2026-20166 — Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise (CVSS 5.4)
- CVE-2026-20165 — Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise (CVSS 6.5)
- CVE-2026-20164 — Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise (CVSS 6.5)
- CVE-2026-20163 — Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise (CVSS 7.2)
- CVE-2026-20162 — Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise (CVSS 6.3)
- CVE-2026-20144 — Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise (CVSS 4.9)
- CVE-2026-20139 — Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise (CVSS 4.3)
- CVE-2026-20137 — Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise (CVSS 5.7)
- CVE-2025-20389 — Improper Input Validation in "label" column field in Splunk Secure Gateway App (CVSS 6.5)