CVE-2026-76272 affects Splunk Enterprise and Splunk Secure Gateway where authorization checks are missing for certain actions. Users without admin or power roles can cause Splunk Secure Gateway to sign attacker-controlled payloads due to lack of verification. This vulnerability affects multiple versions of Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, as well as Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72. The CVSS score is 4.3, indicating a medium severity impact. No known exploits are reported in the wild. The vulnerability allows integrity impact but no confidentiality or availability impact.
CVE-2026-76271 is a denial of service vulnerability in Splunk Enterprise versions 10.0.0 through 10.0.9, 10.2.0 through 10.2.6, and 10.4.0 through 10.4.2. It affects a REST API endpoint in the Discover Splunk Observability Cloud app, where an inefficient regular expression used for input validation can be exploited by a low-privileged user without admin or power roles. This causes excessive computational load, leading to denial of service. Versions 9.4.x are not affected.
CVE-2026-76270 is a SQL injection vulnerability in Splunk Enterprise versions 10.4.0 through 10.4.2. It affects users with the list_spl2_modules capability, allowing them to exploit improper input handling in SPL2 module filtering to access sensitive data via the REST API, including private module definitions of other users. Versions 10.2.x, 10.0.x, and 9.4.x are not affected.
CVE-2026-76269 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 that allows non-admin and non-power users to access other users' search job information via a REST API. This occurs because the API does not properly validate job ownership before returning data. The exposed information includes search query text, job metadata, results, and preview results. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-76268 is a critical vulnerability in Splunk Enterprise versions 10.2.x prior to 10.2.7 and 10.4.x prior to 10.4.3. It allows unauthenticated network users to execute arbitrary operating system commands via the Patroni REST API on search head cluster members, due to lack of authentication on critical configuration operations. Versions 10.0.x and 9.4.x are not affected.
CVE-2026-76267 is a vulnerability in Splunk Enterprise that affects versions prior to 10.4.3, 10.2.7, and 10.0.10. It allows users with the read_o11y_content capability to inject forged log entries via the REST API because the Splunk App for Splunk O11y Cloud does not properly neutralize user-supplied SignalFlow content before logging. Versions 9.4.x are not affected.
CVE-2026-76266 is a privilege escalation vulnerability in Splunk Enterprise on Linux. It affects versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A local user with the ability to run commands as the Splunk Enterprise user can manipulate the installation content. When a Linux package upgrade is performed, this can lead to execution of attacker-controlled commands with root privileges. The vulnerability arises because the package maintainer script trusts existing installation content during upgrades. Exploitation requires a package upgrade after the local user modifies the installation. This vulnerability allows unauthorized privilege escalation from a local user with limited privileges to root.
CVE-2026-76265 is a medium severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where users without admin or power roles can access privileged functionality. This occurs because certain REST API endpoints in Splunk Secure Gateway do not properly enforce authorization checks. Exploiting this, an unauthorized user could cause the gateway to sign attacker-controlled payloads. The issue affects multiple versions of Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, as well as Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72.
CVE-2026-76264 is a medium severity vulnerability in Splunk Enterprise that allows users without admin or power roles to create or edit scripted lookup definitions via raw configuration endpoints. This occurs because the software does not correctly enforce external lookup capability checks on raw transforms configuration write paths. The flaw affects specific versions prior to 10.4.2, 10.2.6, 10.0.10, and 9.4.15.
The Cloudflare Access auth provider module for Backstage versions 0.1.0 up to but not including 0.5.0 does not verify that tokens presented for authentication were issued specifically for the Backstage application. This allows a user with a valid token for another Cloudflare Access application in the same Zero Trust team to authenticate to Backstage if the token reaches the auth endpoint without prior audience enforcement. The vulnerability depends on deployment configurations that allow direct or alternate access to the auth endpoint, bypassing normal Cloudflare Access protections. The impact depends on the permissions assigned to the authenticated identity. A fix is available in version 0.5.0 and later, which requires configuration changes to specify the correct audience.
An authenticated attacker with control over a TechDocs source repository in the Backstage plugin techdocs node can cause a documentation build to retrieve and publish data from network locations accessible by the build environment. The exposure depends on deployment topology, build mode, and endpoint protections. The vulnerability is addressed by upgrading to patched versions that remove MkDocs plugins outside a built-in allowlist. Additional mitigations include restricting repository control and limiting network access during builds.
CVE-2026-106456 is a medium-severity vulnerability in the @backstage/plugin-proxy-backend that allows unauthenticated access to nested proxy routes when overlapping proxy paths have inconsistent credential enforcement. Specifically, if a parent proxy path permits unauthenticated access and a nested path requires credentials, the parent exemption may allow unauthenticated requests to reach the nested upstream service. This can lead to confidentiality and integrity impacts depending on the nested upstream capabilities. The issue affects versions >=0.5.0 and <0.6.18 and is fixed in version 0.6.18 and later.
An inconsistency in repository filtering in the Bitbucket Server catalog event updates of the Backstage plugin allows authenticated users with push access to filtered-out repositories to trigger events that cause these repositories to be ingested into the catalog. This occurs despite configured filters meant to exclude such repositories, potentially leading to unintended trust and ingestion of repository metadata. The issue affects deployments using event-driven updates with readable filtered-out repositories. A fix is available in version 0.5.15 of the plugin.
An improper input validation vulnerability in the Backstage plugin '@backstage/plugin-scaffolder-backend-module-sentry' allows an authenticated internal user with permission to execute certain actions to cause the backend to contact unintended destinations and disclose Sentry integration credentials. This can lead to credential exposure depending on network reachability and token privileges. The issue is fixed in version 0.3.8 and later.
A vulnerability in @backstage/plugin-auth-node affects shared OAuth profile normalization used by several Passport-based authentication providers. The flaw allows an explicitly unverified email address to be passed to email-based sign-in resolvers, potentially enabling an attacker to assume another catalog identity and gain its access and permissions. The issue is fixed in versions 0.6.15 and 0.7.5. Mitigations include requiring verified emails from identity providers or using sign-in resolvers that do not rely on profile emails.
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.
CVE-2026-97717 is a medium severity vulnerability in the proxy sub-system of Absolute Security's Secure Access servers prior to version 14.60. Authenticated attackers can send malformed data to cause a persistent denial of service condition. This vulnerability affects versions from 0 up to but not including 14.60.
CVE-2026-97716 is a high-severity vulnerability in the connection setup subsystem of Absolute Security's Secure Access servers prior to version 14.60. It allows unauthenticated attackers to send specially crafted traffic that causes a persistent denial of service condition.
CVE-2026-34499 is a high-severity vulnerability in Johnson Controls ADVMS before version 3.10. It involves the use of a hard-coded cryptographic key, which allows an attacker with limited privileges to read sensitive constants within the executable. This vulnerability has a CVSS 4.0 score of 8.5, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation information is provided in the available data.