# Vulnerabilities published in 2026


- [CVE-2026-76307](https://insights.sbomify.com/CVE-2026-76307/): Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR (high 7.2)
- [CVE-2026-76306](https://insights.sbomify.com/CVE-2026-76306/): Information Disclosure through REST API Query Filters in Splunk SOAR (high 7.5)
- [CVE-2026-76305](https://insights.sbomify.com/CVE-2026-76305/): Improper Access Control during App Downloads in Splunk SOAR (medium 6.5)
- [CVE-2026-76304](https://insights.sbomify.com/CVE-2026-76304/): Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR (medium 4.3)
- [CVE-2026-76303](https://insights.sbomify.com/CVE-2026-76303/): Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR (medium 5.7)
- [CVE-2026-76302](https://insights.sbomify.com/CVE-2026-76302/): Security Hardening in Splunk Enterprise - October 2026 (critical 9.9)
- [CVE-2026-76301](https://insights.sbomify.com/CVE-2026-76301/): Security Hardening in Splunk Enterprise - October 2026 (critical 9.8)
- [CVE-2026-76300](https://insights.sbomify.com/CVE-2026-76300/): Security Hardening in Splunk Enterprise - October 2026 (high 8.8)
- [CVE-2026-7630](https://insights.sbomify.com/CVE-2026-7630/): innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication (medium 6.9)
- [CVE-2026-76299](https://insights.sbomify.com/CVE-2026-76299/): Security Hardening in Splunk Enterprise - October 2026 (critical 9.9)
- [CVE-2026-76298](https://insights.sbomify.com/CVE-2026-76298/): Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise (high 8.8)
- [CVE-2026-76297](https://insights.sbomify.com/CVE-2026-76297/): Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise (medium 4.2)
- [CVE-2026-76296](https://insights.sbomify.com/CVE-2026-76296/): Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise (medium 4.3)
- [CVE-2026-76295](https://insights.sbomify.com/CVE-2026-76295/): SPL Injection through the REST API in Splunk Secure Gateway (medium 4.3)
- [CVE-2026-76294](https://insights.sbomify.com/CVE-2026-76294/): Improper Access Control in Field Extraction Management in Splunk Enterprise (medium 4.3)
- [CVE-2026-76293](https://insights.sbomify.com/CVE-2026-76293/): Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise (high 7.2)
- [CVE-2026-76292](https://insights.sbomify.com/CVE-2026-76292/): Missing Authorization through REST API Endpoints in Splunk Secure Gateway (medium 6.5)
- [CVE-2026-76291](https://insights.sbomify.com/CVE-2026-76291/): Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise (high 8.8)
- [CVE-2026-76290](https://insights.sbomify.com/CVE-2026-76290/): Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise (high 7.5)
- [CVE-2026-7629](https://insights.sbomify.com/CVE-2026-7629/): kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection (medium 5.3)
- [CVE-2026-76289](https://insights.sbomify.com/CVE-2026-76289/): Denial of Service (DoS) through the REST API in Splunk Enterprise (medium 6.5)
- [CVE-2026-76288](https://insights.sbomify.com/CVE-2026-76288/): Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise (high 7.5)
- [CVE-2026-76287](https://insights.sbomify.com/CVE-2026-76287/): Authorization Bypass in the Data Management REST API in Splunk Enterprise (medium 5.4)
- [CVE-2026-76286](https://insights.sbomify.com/CVE-2026-76286/): Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server (medium 5.3)
- [CVE-2026-76285](https://insights.sbomify.com/CVE-2026-76285/): Improper Adherence to Coding Standards in Splunk Enterprise (critical 9.8)
- [CVE-2026-76284](https://insights.sbomify.com/CVE-2026-76284/): Improper Neutralization in Splunk Enterprise (critical 9.8)
- [CVE-2026-76283](https://insights.sbomify.com/CVE-2026-76283/): Protection Mechanism Failure in Splunk Enterprise (high 7.6)
- [CVE-2026-76282](https://insights.sbomify.com/CVE-2026-76282/): Improper Control of a Resource Through its Lifetime in Splunk Enterprise (high 8.8)
- [CVE-2026-76281](https://insights.sbomify.com/CVE-2026-76281/): Improper Access Control in Splunk Enterprise (not scored)
- [CVE-2026-76280](https://insights.sbomify.com/CVE-2026-76280/): Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway (medium 6.3)
- [CVE-2026-7628](https://insights.sbomify.com/CVE-2026-7628/): crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection (medium 5.3)
- [CVE-2026-76279](https://insights.sbomify.com/CVE-2026-76279/): Improper Input Validation of Index Names through the collect Command in Splunk Enterprise (medium 4.3)
- [CVE-2026-76278](https://insights.sbomify.com/CVE-2026-76278/): Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise (medium 4.3)
- [CVE-2026-76277](https://insights.sbomify.com/CVE-2026-76277/): Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise (medium 4.1)
- [CVE-2026-76276](https://insights.sbomify.com/CVE-2026-76276/): Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise (medium 4.3)
- [CVE-2026-76275](https://insights.sbomify.com/CVE-2026-76275/): Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise (medium 4.3)
- [CVE-2026-76274](https://insights.sbomify.com/CVE-2026-76274/): Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud (medium 6.5)
- [CVE-2026-76273](https://insights.sbomify.com/CVE-2026-76273/): Improper Input Validation through the collect Command in Splunk Enterprise (medium 4.3)
- [CVE-2026-76272](https://insights.sbomify.com/CVE-2026-76272/): Missing Access Control through the REST API in Splunk Secure Gateway (medium 4.3)
- [CVE-2026-76271](https://insights.sbomify.com/CVE-2026-76271/): Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise (medium 6.5)
- [CVE-2026-76270](https://insights.sbomify.com/CVE-2026-76270/): Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise (medium 6.5)
- [CVE-2026-7627](https://insights.sbomify.com/CVE-2026-7627/): 8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal (medium 5.3)
- [CVE-2026-76269](https://insights.sbomify.com/CVE-2026-76269/): Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise (medium 6.5)
- [CVE-2026-76268](https://insights.sbomify.com/CVE-2026-76268/): Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise (critical 9.8)
- [CVE-2026-76267](https://insights.sbomify.com/CVE-2026-76267/): Log Injection through the REST API in Splunk App for Splunk O11y Cloud (medium 4.3)
- [CVE-2026-76266](https://insights.sbomify.com/CVE-2026-76266/): Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise (high 7.7)
- [CVE-2026-76265](https://insights.sbomify.com/CVE-2026-76265/): Improper Access Control through REST API Endpoints in Splunk Secure Gateway (medium 6.5)
- [CVE-2026-76264](https://insights.sbomify.com/CVE-2026-76264/): Improper Authorization through the REST API in Splunk Enterprise (medium 4.3)
- [CVE-2026-76263](https://insights.sbomify.com/CVE-2026-76263/): Improper Access Control through the REST API in Splunk Enterprise (medium 5.4)
- [CVE-2026-76262](https://insights.sbomify.com/CVE-2026-76262/): Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise (high 7.5)
- [CVE-2026-76261](https://insights.sbomify.com/CVE-2026-76261/): Insecure Default Access Control List through the REST API in Splunk Secure Gateway (medium 5.3)
- [CVE-2026-76260](https://insights.sbomify.com/CVE-2026-76260/): Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise (medium 6.5)
- [CVE-2026-7626](https://insights.sbomify.com/CVE-2026-7626/): Information disclosure in Slek Gateway for WooCommerce (medium 5.3)
- [CVE-2026-76259](https://insights.sbomify.com/CVE-2026-76259/): Improper Privilege Management on the Management Port in Splunk Enterprise for Windows (high 8.8)
- [CVE-2026-76258](https://insights.sbomify.com/CVE-2026-76258/): Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway (medium 6.5)
- [CVE-2026-76257](https://insights.sbomify.com/CVE-2026-76257/): Missing Authorization through REST API Endpoints in Splunk Secure Gateway (medium 6.5)
- [CVE-2026-76256](https://insights.sbomify.com/CVE-2026-76256/): Information Exposure through REST API Endpoints in Splunk Secure Gateway (medium 4.3)
- [CVE-2026-76255](https://insights.sbomify.com/CVE-2026-76255/): Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise (medium 6.4)
- [CVE-2026-76254](https://insights.sbomify.com/CVE-2026-76254/): SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise (high 7.5)
- [CVE-2026-76253](https://insights.sbomify.com/CVE-2026-76253/): Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise (high 8.8)
- [CVE-2026-76252](https://insights.sbomify.com/CVE-2026-76252/): Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise (medium 6.8)
- [CVE-2026-76251](https://insights.sbomify.com/CVE-2026-76251/): Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud (high 7.1)
- [CVE-2026-76245](https://insights.sbomify.com/CVE-2026-76245/): stigmem Federation Peer Token Timestamp Validation Bypass (high 7.1)
- [CVE-2026-76244](https://insights.sbomify.com/CVE-2026-76244/): stigmem-node Insecure Federation Transport Configuration (critical 9.1)
- [CVE-2026-76243](https://insights.sbomify.com/CVE-2026-76243/): stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth (critical 9.2)
- [CVE-2026-76242](https://insights.sbomify.com/CVE-2026-76242/): stigmem Federation Peer Registration Authentication Bypass (critical 9.1)
- [CVE-2026-76241](https://insights.sbomify.com/CVE-2026-76241/): stigmem Plugin Signature Enforcement Bypass via Configuration (high 7.3)
- [CVE-2026-76240](https://insights.sbomify.com/CVE-2026-76240/): stigmem Postgres SQL Injection via Schema Identifier (high 7.5)
- [CVE-2026-7624](https://insights.sbomify.com/CVE-2026-7624/): Missing authorization in SEO Plugin by Squirrly SEO (medium 4.3)
- [CVE-2026-76239](https://insights.sbomify.com/CVE-2026-76239/): Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address (medium 5.3)
- [CVE-2026-76238](https://insights.sbomify.com/CVE-2026-76238/): stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep (high 7.2)
- [CVE-2026-76237](https://insights.sbomify.com/CVE-2026-76237/): stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine (high 8.6)
- [CVE-2026-76236](https://insights.sbomify.com/CVE-2026-76236/): stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones (high 7.2)
- [CVE-2026-76235](https://insights.sbomify.com/CVE-2026-76235/): Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html (high 7.5)
- [CVE-2026-76234](https://insights.sbomify.com/CVE-2026-76234/): libcrux before 0.0.6 Cryptographic Implementation Bug Fixes (high 8.7)
- [CVE-2026-76233](https://insights.sbomify.com/CVE-2026-76233/): Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager (high 8.4)
- [CVE-2026-76232](https://insights.sbomify.com/CVE-2026-76232/): Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 (high 8.4)
- [CVE-2026-76231](https://insights.sbomify.com/CVE-2026-76231/): Renovate 32.135.0 before 40.33.0 Command Injection via hermit (high 8.4)
- [CVE-2026-76230](https://insights.sbomify.com/CVE-2026-76230/): Renovate 35.63.0 before 40.33.0 Command Injection via npm (high 8.4)
- [CVE-2026-7623](https://insights.sbomify.com/CVE-2026-7623/): SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute (medium 6.4)
- [CVE-2026-76229](https://insights.sbomify.com/CVE-2026-76229/): Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize (high 8.4)
- [CVE-2026-76228](https://insights.sbomify.com/CVE-2026-76228/): Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper (high 8.4)
- [CVE-2026-76227](https://insights.sbomify.com/CVE-2026-76227/): Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure (medium 6.8)
- [CVE-2026-76226](https://insights.sbomify.com/CVE-2026-76226/): Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance (medium 6.8)
- [CVE-2026-76225](https://insights.sbomify.com/CVE-2026-76225/): ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV (high 8.3)
- [CVE-2026-76224](https://insights.sbomify.com/CVE-2026-76224/): ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback (high 8.7)
- [CVE-2026-76223](https://insights.sbomify.com/CVE-2026-76223/): ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION (high 7.1)
- [CVE-2026-76222](https://insights.sbomify.com/CVE-2026-76222/): GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name (high 8.4)
- [CVE-2026-76221](https://insights.sbomify.com/CVE-2026-76221/): GitPython before 3.1.58 Config Injection via option-name (high 8.7)
- [CVE-2026-76220](https://insights.sbomify.com/CVE-2026-76220/): GitPython before 3.1.58 Command Execution via split_single_char_options (high 8.7)
- [CVE-2026-7622](https://insights.sbomify.com/CVE-2026-7622/): ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation (medium 4.3)
- [CVE-2026-76219](https://insights.sbomify.com/CVE-2026-76219/): GitPython before 3.1.58 Arbitrary File Overwrite via read-tree (high 7.2)
- [CVE-2026-76218](https://insights.sbomify.com/CVE-2026-76218/): GitPython before 3.1.58 Remote Code Execution via Repo.init (high 7.7)
- [CVE-2026-76217](https://insights.sbomify.com/CVE-2026-76217/): GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file (high 7.1)
- [CVE-2026-76216](https://insights.sbomify.com/CVE-2026-76216/): Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing (high 7.7)
- [CVE-2026-76215](https://insights.sbomify.com/CVE-2026-76215/): phpMyFAQ before 4.1.7 Missing Authorization via child resources (medium 6.9)
- [CVE-2026-76214](https://insights.sbomify.com/CVE-2026-76214/): phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge (critical 9.1)
- [CVE-2026-76213](https://insights.sbomify.com/CVE-2026-76213/): phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle (critical 9.1)
- [CVE-2026-76212](https://insights.sbomify.com/CVE-2026-76212/): phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL (medium 6.9)
- [CVE-2026-76211](https://insights.sbomify.com/CVE-2026-76211/): phpMyFAQ before 4.1.7 Information Disclosure via Admin API (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/379/