Splunk
Number 54 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
347
Critical
19
High
123
Known Exploited
1
Exploit available
1
Network, no login needed
22.0%
Of 341 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 197 | 18 | 63 | 109 | 6 | 1 |
| 2025 | 38 | 0 | 6 | 24 | 8 | 0 |
| 2024 | 41 | 0 | 14 | 26 | 1 | 0 |
| 2023 | 36 | 0 | 19 | 17 | 0 | 0 |
| 2022 | 31 | 1 | 21 | 6 | 2 | 1 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2017 | 4 | 0 | 0 | 0 | 0 | 4 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Splunk Enterprise | 259 | 108 |
| Splunk SOAR | 31 | 13 |
| Splunk AI Toolkit | 12 | 7 |
| Splunk Connect for Kafka | 4 | 2 |
| AD LDAP app for Splunk SOAR | 3 | 0 |
| Splunk Add-on Builder | 3 | 2 |
| Splunk App for Lookup File Editing | 3 | 1 |
| Splunk MCP Server | 3 | 1 |
| Cisco Talos Intelligence for Enterprise Security Cloud | 2 | 1 |
| Splunk Enterprise Security | 2 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Information Disclosure | 39 | 9 |
| Cross-Site Scripting | 31 | 9 |
| Improper Input Validation | 29 | 13 |
| Improper Access Control | 22 | 9 |
| Missing Authorization | 21 | 5 |
| The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. | 12 | 0 |
| Denial of Service | 11 | 3 |
| Server-Side Request Forgery | 11 | 5 |
| The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. | 11 | 5 |
| The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. | 9 | 3 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-20253 | Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Critical | 96.9% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-76531 | Files or Directories Accessible to External Parties in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76530 | Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR | High | 0.3% | |
| CVE-2026-76529 | Improper Protection of Alternate Path in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76528 | Protection Mechanism Failure in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76527 | Improper Check or Handling of Exceptional Conditions in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76526 | Improper Neutralization in Splunk SOAR | High | 0.4% | |
| CVE-2026-76408 | Improper Control of a Resource Through its Lifetime in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76407 | Improper Access Control in Splunk SOAR | Critical | 0.4% | |
| CVE-2026-76406 | Information Disclosure through REST API Authentication in Splunk SOAR | Medium | 0.3% | |
| CVE-2026-76308 | Missing Authorization through the REST API in Splunk SOAR | Medium | 0.2% |