# Splunk Enterprise. Every CVE that names Splunk Enterprise among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20142.md) `CVE-2026-20142` · CVE record: Splunk Splunk Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure - [Sensitive Information Disclosure in "\_internal" index in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20138.md) `CVE-2026-20138` · CVE record: Splunk Splunk Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure - [Client-Side Denial of Service (DoS) through ''/splunkd/\_\_raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20139.md) `CVE-2026-20139` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Denial of service - [Sensitive Information Disclosure in ''\_internal'' index in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20144.md) `CVE-2026-20144` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure - [Improper Access Control in Splunk Monitoring Console App](https://agentprime.io/advisories/CVE-2026-20141.md) `CVE-2026-20141` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure - [Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20137.md) `CVE-2026-20137` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.5 Low · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure - [Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20388.md) `CVE-2025-20388` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 2.7 Low · Not analysed yet · Published 3 Dec 2025 · Tags: Server-side request forgery (SSRF) - [Improper Input Validation in "label" column field in Splunk Secure Gateway App](https://agentprime.io/advisories/CVE-2025-20389.md) `CVE-2025-20389` · CVE record: Splunk Splunk Enterprise and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-20 - [Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade](https://agentprime.io/advisories/CVE-2025-20387.md) `CVE-2025-20387` · CVE record: Splunk Splunk Enterprise · CVSS 8.0 High · Not analysed yet · Published 3 Dec 2025 · Tags: Broken access control - [Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app](https://agentprime.io/advisories/CVE-2025-20383.md) `CVE-2025-20383` · CVE record: Splunk Splunk Enterprise and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Information disclosure - [Unauthenticated Log Injection in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20384.md) `CVE-2025-20384` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Other injection - [Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade](https://agentprime.io/advisories/CVE-2025-20386.md) `CVE-2025-20386` · CVE record: Splunk Splunk Enterprise · CVSS 8.0 High · Not analysed yet · Published 3 Dec 2025 · Tags: Broken access control - [Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20385.md) `CVE-2025-20385` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 2.4 Low · Not analysed yet · Published 3 Dec 2025 · Tags: Cross-site scripting (XSS) - [URL validation bypass through Views Dashboard in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20382.md) `CVE-2025-20382` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.5 Low · Not analysed yet · Published 3 Dec 2025 · Tags: Open redirect - [Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20379.md) `CVE-2025-20379` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.5 Low · Not analysed yet · Published 12 Nov 2025 · Tags: Information disclosure - [Open Redirect on Web Login endpoint in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20378.md) `CVE-2025-20378` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.1 Low · Not analysed yet · Published 12 Nov 2025 · Tags: Open redirect - [Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20368.md) `CVE-2025-20368` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Cross-site scripting (XSS) - [Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20371.md) `CVE-2025-20371` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2025 · Tags: Server-side request forgery (SSRF) - [Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20367.md) `CVE-2025-20367` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Cross-site scripting (XSS) - [Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20370.md) `CVE-2025-20370` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Denial of service - [Improper Access Control in Background Job Submission in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20366.md) `CVE-2025-20366` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Broken access control - [Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20369.md) `CVE-2025-20369` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Denial of service - [Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20322.md) `CVE-2025-20322` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Missing Access Control of Saved Searches in the Splunk Archiver app](https://agentprime.io/advisories/CVE-2025-20323.md) `CVE-2025-20323` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Broken access control - [Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20321.md) `CVE-2025-20321` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site request forgery (CSRF) - [Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20325.md) `CVE-2025-20325` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.1 Low · Not analysed yet · Published 7 Jul 2025 · Tags: Information disclosure - [Remote Command Execution through Scripted Input Files in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20319.md) `CVE-2025-20319` · CVE record: Splunk Splunk Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Command injection - [Improper Access Control in System Source Types Configuration in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20324.md) `CVE-2025-20324` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Broken access control - [Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20320.md) `CVE-2025-20320` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Path traversal - [Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20300.md) `CVE-2025-20300` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Broken access control - [Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component](https://agentprime.io/advisories/CVE-2025-20297.md) `CVE-2025-20297` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · EPSS 0.31 · Not analysed yet · Published 2 Jun 2025 · Tags: Cross-site scripting (XSS) - [Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App](https://agentprime.io/advisories/CVE-2025-20230.md) `CVE-2025-20230` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Broken access control - [Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20232.md) `CVE-2025-20232` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Information disclosure - [Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20229.md) `CVE-2025-20229` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.0 High · Critical (CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 26 Mar 2025 · Tags: Broken access control - [Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20228.md) `CVE-2025-20228` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio](https://agentprime.io/advisories/CVE-2025-20227.md) `CVE-2025-20227` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: CWE-20 - [Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise](https://agentprime.io/advisories/CVE-2025-20226.md) `CVE-2025-20226` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: Information disclosure - [Sensitive Information Disclosure in Splunk Secure Gateway App](https://agentprime.io/advisories/CVE-2025-20231.md) `CVE-2025-20231` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 26 Mar 2025 · Tags: Information disclosure - [Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter](https://agentprime.io/advisories/CVE-2024-53244.md) `CVE-2024-53244` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: Information disclosure - [Sensitive Information Disclosure through SPL commands](https://agentprime.io/advisories/CVE-2024-53246.md) `CVE-2024-53246` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: Weak cryptography or TLS - [Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2024-53243.md) `CVE-2024-53243` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: Information disclosure - [Information Disclosure due to Username Collision with a Role that has the same Name as the User](https://agentprime.io/advisories/CVE-2024-53245.md) `CVE-2024-53245` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 3.1 Low · Not analysed yet · Published 10 Dec 2024 · Tags: Information disclosure - [Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app](https://agentprime.io/advisories/CVE-2024-53247.md) `CVE-2024-53247` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.8 High · Not analysed yet · Published 10 Dec 2024 · Tags: Insecure deserialization - [Sensitive information disclosure in AdminManager logging channel](https://agentprime.io/advisories/CVE-2024-45739.md) `CVE-2024-45739` · CVE record: Splunk Splunk Enterprise · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Information disclosure - [Sensitive information disclosure in REST_Calls logging channel](https://agentprime.io/advisories/CVE-2024-45738.md) `CVE-2024-45738` · CVE record: Splunk Splunk Enterprise · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Information disclosure - [Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)](https://agentprime.io/advisories/CVE-2024-45737.md) `CVE-2024-45737` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Cross-site request forgery (CSRF) - [Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows](https://agentprime.io/advisories/CVE-2024-45733.md) `CVE-2024-45733` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2024 · Tags: Insecure deserialization - [Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app](https://agentprime.io/advisories/CVE-2024-45732.md) `CVE-2024-45732` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2024 · Tags: Broken access control - [Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon](https://agentprime.io/advisories/CVE-2024-45736.md) `CVE-2024-45736` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Denial of service - [Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise](https://agentprime.io/advisories/CVE-2024-45741.md) `CVE-2024-45741` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · EPSS 0.15 · Not analysed yet · Published 14 Oct 2024 · Tags: Cross-site scripting (XSS) - [Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard](https://agentprime.io/advisories/CVE-2024-45734.md) `CVE-2024-45734` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Broken access control - [Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise](https://agentprime.io/advisories/CVE-2024-45740.md) `CVE-2024-45740` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Cross-site scripting (XSS) - [Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk](https://agentprime.io/advisories/CVE-2024-45731.md) `CVE-2024-45731` · CVE record: Splunk Splunk Enterprise · CVSS 8.0 High · Not analysed yet · Published 14 Oct 2024 · Tags: Path traversal - [Improper Access Control for low-privileged user in Splunk Secure Gateway App](https://agentprime.io/advisories/CVE-2024-45735.md) `CVE-2024-45735` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: Broken access control - [Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint](https://agentprime.io/advisories/CVE-2024-36997.md) `CVE-2024-36997` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Cross-site scripting (XSS) - [Persistent Cross-site Scripting (XSS) in Web Bulletin](https://agentprime.io/advisories/CVE-2024-36993.md) `CVE-2024-36993` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Cross-site scripting (XSS) - [Low-privileged user could create experimental items](https://agentprime.io/advisories/CVE-2024-36995.md) `CVE-2024-36995` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Broken access control - [Denial of Service through null pointer reference in “cluster/config” REST endpoint](https://agentprime.io/advisories/CVE-2024-36982.md) `CVE-2024-36982` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2024 · Tags: Memory corruption - [Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows](https://agentprime.io/advisories/CVE-2024-36991.md) `CVE-2024-36991` · CVE record: Splunk Splunk Enterprise · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 1 Jul 2024 · Tags: Path traversal - [Denial of Service (DoS) on the datamodel/web REST endpoint](https://agentprime.io/advisories/CVE-2024-36990.md) `CVE-2024-36990` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .