Skip to content
Noroxi

Splunk records

407 published records for vendor Splunk. 2 of them have been exploited in the wild (listed in CISA KEV) and 8 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
2 · 0.5%
Weaponized
8 · 2%
Pre-auth RCE
7
With a fix record
14.7%
Median publish → KEV
1479 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

407 records
  • CVE-2026-20253
    98Now

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    splunk · splunkJun 10, 2026

  • CVE-2014-0160
    90Now

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    openssl · opensslApr 7, 2014

  • CVE-2023-46214
    62This week

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    HighCVSS 8.8WeaponizedEPSS 89%

    splunk · cloudNov 16, 2023

  • CVE-2018-11409
    60This week

    Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon

    MediumCVSS 5.3WeaponizedEPSS 98%

    splunk · splunkJun 8, 2018

  • CVE-2023-32707
    59Plan

    ‘edit_user’ Capability Privilege Escalation

    HighCVSS 8.8WeaponizedEPSS 78%

    splunk · splunkJun 1, 2023

  • CVE-2021-22901
    51Plan

    curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t

    HighCVSS 8.1No exploitEPSS 63%

    haxx · curlJun 11, 2021

  • CVE-2023-32714
    45Plan

    Path Traversal in Splunk App for Lookup File Editing

    HighCVSS 8.1No exploitEPSS 42%

    splunk · splunkJun 1, 2023

  • CVE-2026-20251
    44Plan

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    HighCVSS 8.8Proof of conceptEPSS 30%

    splunk · splunkJun 10, 2026

  • CVE-2022-32207
    43Plan

    When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a ren

    CriticalCVSS 9.8No exploitEPSS 12%

    haxx · curlJul 7, 2022

  • CVE-2021-30560
    41Plan

    Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8No exploitEPSS 20%

    google · chromeAug 3, 2021

  • CVE-2022-43571
    41Plan

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    HighCVSS 8.8WeaponizedEPSS 18%

    splunk · splunkNov 3, 2022

  • CVE-2026-76268
    41Plan

    Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    splunk · splunkOct 7, 2026

  • CVE-2022-32221
    41Plan

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when th

    CriticalCVSS 9.8No exploitEPSS 5%

    haxx · curlDec 5, 2022

  • CVE-2011-4642
    40Plan

    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allo

    MediumCVSS 4.6WeaponizedEPSS 28%

    splunk · splunkJan 3, 2012

  • CVE-2024-36985
    40Plan

    Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

    HighCVSS 8.8WeaponizedEPSS 6%

    splunk · splunkJul 1, 2024

  • CVE-2016-10126
    40Plan

    Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and

    CriticalCVSS 9.8No exploitEPSS 3%

    splunk · splunkJan 10, 2017

  • CVE-2021-3520
    40Plan

    There's a flaw in lz4.

    CriticalCVSS 9.8No exploitEPSS 3%

    lz4 project · lz4Jun 2, 2021

  • CVE-2017-17067
    40Plan

    Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12,

    CriticalCVSS 9.8No exploitEPSS 2%

    splunk · splunkNov 29, 2017

  • CVE-2022-36227
    40Plan

    In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th

    CriticalCVSS 9.8No exploitEPSS 2%

    libarchive · libarchiveNov 22, 2022

  • CVE-2022-32158
    40Plan

    Splunk Enterprise deployment servers allow client publishing of forwarder bundles

    CriticalCVSS 10.0No exploitEPSS 1%

    splunk · splunkJun 15, 2022

  • CVE-2011-4644
    39Monitor

    Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality within an environment that intentio

    CriticalCVSS 9.3Proof of conceptEPSS 7%

    splunk · splunkJan 3, 2012

  • CVE-2022-37437
    39Monitor

    Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation

    CriticalCVSS 9.8No exploitEPSS 0%

    splunk · splunkAug 16, 2022

  • CVE-2026-76284
    39Monitor

    Improper Neutralization in Splunk Enterprise

    CriticalCVSS 9.8No exploitEPSS 0%

    splunk · splunkOct 7, 2026

  • CVE-2026-76285
    39Monitor

    Improper Adherence to Coding Standards in Splunk Enterprise

    CriticalCVSS 9.8No exploitEPSS 0%

    splunk · splunkOct 7, 2026

  • CVE-2023-32713
    39Monitor

    Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

    CriticalCVSS 9.9No exploitEPSS 0%

    splunk · splunk app for streamJun 1, 2023