Search: 16.5-2

CVE-2026-76292 affects certain versions of Splunk Enterprise and Splunk Secure Gateway where low-privileged users without admin roles can read mobile alert notification data of other users. This occurs due to missing user-level authorization checks on read requests to the Splunk Secure Gateway App Key Value Store REST API endpoints. The issue is fixed in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions 3.10.12, 3.9.26, and 3.8.73.

CVE-2026-76291 affects Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. It allows users with the schedule_search capability to bypass safeguards in the scheduled search workflow and execute risky SPL commands. These commands can disclose or modify data or disrupt availability. The vulnerability arises because the search scheduler does not enforce SPL safeguards on scheduled searches. A fix is available in the specified patched versions.

CVE-2026-76289 is a denial-of-service vulnerability in Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. A user without admin or power roles can send crafted requests to the REST API endpoint for lookup table files, causing resource exhaustion that makes the instance unavailable to other users until it is restarted.

CVE-2026-76288 is a denial-of-service vulnerability in Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. An unauthenticated attacker can send a crafted request to the Splunk Web JavaScript logger endpoint, causing Splunk Web to become unresponsive until the service is restarted. The issue arises from insufficient limits on request-header parsing in Splunk Web.

A medium severity vulnerability (CVE-2026-114501) affects the Pillow Python imaging library versions from 11.2.1 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 score of 6.3, indicating a network exploitable issue with low complexity and no user interaction required. The exact technical details of the flaw are not fully provided in the input data.

Rex versions up to 1.16.1 for Perl have a vulnerability where remote rsync transfers accept unknown SSH host keys due to hardcoded StrictHostKeyChecking=no. This allows an attacker who can redirect the connection to present their own host key, causing the transfer to proceed without verifying the server's authenticity. Passwords and file transfers can be exposed or redirected as a result.

A high-severity vulnerability (CVE-2026-96640) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The issue involves the PdfParser component, though specific technical details are not provided. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network-exploitable flaw with high impact. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are available in the provided data.

A vulnerability exists in the Pillow Python imaging library affecting versions from 9.1.0 up to but not including 13.0.0. The issue relates to the BmpRleDec component. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily affecting availability. No public exploits or known active exploitation have been reported. The affected versions include specific Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 involving the MpoImageFile.seek function. The flaw can cause a denial of service condition. The issue affects multiple Ubuntu package versions of Pillow. The CVSS score is 6.5, indicating a medium severity impact primarily due to availability disruption.

A high-severity vulnerability (CVE-2026-114145) in python-git (GitPython) allows remote code execution due to validation of a submodule's .git path only occurring after cloning into it. This flaw affects multiple specific versions of the python-git package. The vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and availability. No public exploits or known in-the-wild exploitation have been reported. The vulnerability is not related to a cloud service and no patch information is provided in the data.

CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.

CVE-2026-96644 is an out-of-bounds read vulnerability in the python-pillow Pillow library affecting Windows builds. It arises from improper handling of EMF and WMF image dimensions, where 32-bit dimensions are truncated to 16-bit fields for allocation but used fully for copying data, causing a heap over-read. This can lead to memory disclosure or application crashes when processing crafted metafiles. The flaw is fixed in Pillow version 13.0.0.

CVE-2026-96641 is an integer overflow vulnerability in the python-pillow Pillow library prior to version 13.0.0. The flaw occurs in the PILfont text-width accumulation code where negative glyph advances are not properly checked against INT_MIN, allowing a signed 16-bit advance of -32768 to cause an integer overflow. This results in a large positive width from a negative calculation, potentially causing logic errors or excessive resource consumption in applications using text layout or size calculations. The issue is fixed in Pillow version 13.0.0.

CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.

Apache Traffic Server contains a vulnerability that can cause the server to crash due to a null pointer dereference. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity impact primarily affecting availability without compromising confidentiality or integrity.

Apache Traffic Server contains a vulnerability that can cause it to stall a chunked transfer it processes. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating it can impact availability but does not affect confidentiality or integrity.

Apache Traffic Server contains a critical vulnerability (CVE-2026-111815) that allows TLS session resumption across different SNI virtual hosts. This flaw can lead to a complete compromise of confidentiality and integrity of TLS sessions. The vulnerability affects multiple specific versions of Traffic Server and has a CVSS score of 10.0, indicating critical severity.

Apache Traffic Server versions including 9.2.15, 10.1.4, and 10.2.0 have a vulnerability identified as CVE-2026-111810. The issue involves an unthrottled write operation, which can lead to a high severity impact on availability. The CVSS score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Apache Traffic Server contains a vulnerability (CVE-2026-111805) that can be exploited to exhaust an HTTP/1.1 origin server's resources, leading to denial of service. The flaw affects multiple specific versions of Traffic Server. The CVSS score is 8.6, indicating a high severity impact primarily on availability. No public exploits or vendor patch information are provided in the data.