# Splunk SOAR.

Every CVE that names Splunk SOAR among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Files or Directories Accessible to External Parties in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76531.md)
  `CVE-2026-76531` · CVE record: Splunk Splunk SOAR · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76530.md)
  `CVE-2026-76530` · CVE record: Splunk Splunk SOAR · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-647
- [Improper Protection of Alternate Path in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76529.md)
  `CVE-2026-76529` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-424
- [Protection Mechanism Failure in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76528.md)
  `CVE-2026-76528` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [Improper Check or Handling of Exceptional Conditions in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76527.md)
  `CVE-2026-76527` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-703
- [Improper Neutralization in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76526.md)
  `CVE-2026-76526` · CVE record: Splunk Splunk SOAR · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-707
- [Improper Control of a Resource Through its Lifetime in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76408.md)
  `CVE-2026-76408` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-664
- [Improper Access Control in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76407.md)
  `CVE-2026-76407` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Information Disclosure through REST API Authentication in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76406.md)
  `CVE-2026-76406` · CVE record: Splunk Splunk SOAR · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Missing Authorization through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76308.md)
  `CVE-2026-76308` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76307.md)
  `CVE-2026-76307` · CVE record: Splunk Splunk SOAR · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Information Disclosure through REST API Query Filters in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76306.md)
  `CVE-2026-76306` · CVE record: Splunk Splunk SOAR · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Improper Access Control during App Downloads in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76305.md)
  `CVE-2026-76305` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76304.md)
  `CVE-2026-76304` · CVE record: Splunk Splunk SOAR · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76303.md)
  `CVE-2026-76303` · CVE record: Splunk Splunk SOAR · CVSS 5.7 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Information Disclosure through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76370.md)
  `CVE-2026-76370` · CVE record: Splunk Splunk SOAR · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Path Traversal through Automation Broker in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76369.md)
  `CVE-2026-76369` · CVE record: Splunk Splunk SOAR · CVSS 2.7 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Missing Authorization through Playbooks in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76368.md)
  `CVE-2026-76368` · CVE record: Splunk Splunk SOAR · CVSS 2.7 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Stored Cross-Site Scripting (XSS) through Notes in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76367.md)
  `CVE-2026-76367` · CVE record: Splunk Splunk SOAR · CVSS 4.0 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Information Disclosure through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76366.md)
  `CVE-2026-76366` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Information disclosure
- [Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76365.md)
  `CVE-2026-76365` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76364.md)
  `CVE-2026-76364` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection
- [Structured Query Language Injection through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76363.md)
  `CVE-2026-76363` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection
- [Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76362.md)
  `CVE-2026-76362` · CVE record: Splunk Splunk SOAR · CVSS 7.4 High · Not analysed yet · Published 19 Aug 2026 · Tags: Weak cryptography or TLS
- [Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76361.md)
  `CVE-2026-76361` · CVE record: Splunk Splunk SOAR · CVSS 2.7 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76360.md)
  `CVE-2026-76360` · CVE record: Splunk Splunk SOAR · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76359.md)
  `CVE-2026-76359` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Path Traversal through App Installation Tar Extraction in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76358.md)
  `CVE-2026-76358` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76357.md)
  `CVE-2026-76357` · CVE record: Splunk Splunk SOAR · CVSS 7.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76356.md)
  `CVE-2026-76356` · CVE record: Splunk Splunk SOAR · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [Log Injection through HTTP Request Paths in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-20260.md)
  `CVE-2026-20260` · CVE record: Splunk Splunk SOAR · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=splunk-soar>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/splunk-soar/>. Everything for agents: <https://agentprime.io/llms.txt>.