# Splunk Splunk Cloud Platform


- [CVE-2026-20251](https://insights.sbomify.com/CVE-2026-20251/): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway (high 8.8)
- [CVE-2023-40595](https://insights.sbomify.com/CVE-2023-40595/): Remote Code Execution via Serialized Session Payload (high 8.8)
- [CVE-2023-32707](https://insights.sbomify.com/CVE-2023-32707/): ‘edit_user’ Capability Privilege Escalation (high 8.8)
- [CVE-2022-43567](https://insights.sbomify.com/CVE-2022-43567/): Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature (high 8.8)
- [CVE-2022-43568](https://insights.sbomify.com/CVE-2022-43568/): Reflected Cross-Site Scripting via the radio template in Splunk Enterprise (high 8.8)
- [CVE-2022-43570](https://insights.sbomify.com/CVE-2022-43570/): XML External Entity Injection through a custom View in Splunk Enterprise (high 8.8)
- [CVE-2022-43571](https://insights.sbomify.com/CVE-2022-43571/): Remote Code Execution through dashboard PDF generation component in Splunk Enterprise (high 8.8)
- [CVE-2023-40598](https://insights.sbomify.com/CVE-2023-40598/): Command Injection in Splunk Enterprise Using External Lookups (high 8.5)
- [CVE-2023-40592](https://insights.sbomify.com/CVE-2023-40592/): Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint (high 8.4)
- [CVE-2026-20296](https://insights.sbomify.com/CVE-2026-20296/): SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise (high 8.3)
- [CVE-2023-22935](https://insights.sbomify.com/CVE-2023-22935/): SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise (high 8.1)
- [CVE-2023-22939](https://insights.sbomify.com/CVE-2023-22939/): SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/splunk/splunk-cloud-platform/