CVE-2026-78143 is a SQL injection vulnerability in version 1.0 of the Barangay Resident Profiling Management System affecting the Resident Search functionality in the residents.php file. This flaw allows remote attackers to manipulate the Search argument to execute unauthorized SQL commands. The vulnerability has a CVSS 3.1 score of 7.3, indicating medium severity. There are no known exploits in the wild and no official patch or remediation information is currently available.
Combodo iTop versions prior to 3.2.3 contain a reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser. The issue has been fixed in version 3.2.3.
CVE-2026-55769 is a critical vulnerability in cloudnative-pg prior to versions 1.28.4 and 1.29.2. It involves an untrusted search path issue where superuser connections were opened without pinning the search_path, allowing roles with DATABASE OWNER privileges to execute attacker-controlled functions as the PostgreSQL superuser. This flaw enables privilege escalation to superuser, operating system command execution, and access to sensitive pod tokens. The issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Splunk Enterprise versions below 10.4.2 contain a vulnerability where a user with a high-privilege role managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations writable by the Splunk process. This can lead to remote code execution, potentially compromising data confidentiality, integrity, and availability. The issue arises from insufficient authorization checks and lack of validation on bundle paths. The vulnerability does not affect versions below 10.4. No official patch information is provided in the source data.
In certain versions of Splunk Enterprise prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the "power" role can store risky Search Processing Language (SPL) commands in a Table Editor dataset and share it. When a user with the "admin" role opens this dataset, the stored commands execute with the admin's permissions, potentially exposing sensitive data and modifying lookup files. This occurs because the Table Editor does not apply SPL safeguards to the field-summary search during the Initial Data step. Exploitation requires phishing an admin user to open the crafted dataset in their browser. The vulnerability is rated medium severity with a CVSS score of 5.4.
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where an unauthenticated attacker can trick an admin user into opening a crafted Monitoring Console link. This causes the system to execute attacker-controlled Search Processing Language (SPL) commands with the admin user's permissions. The flaw arises from insufficient validation of data used in dashboard searches. Exploitation requires phishing the admin user to open the malicious link, and the attacker cannot exploit the vulnerability without user interaction.
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where an unauthenticated attacker can trick an authenticated user into opening a crafted Monitoring Console link. This causes the authenticated user's Splunk instance to execute attacker-controlled Search Processing Language (SPL) commands with the user's permissions. The flaw arises from insufficient validation of data used in forwarder dashboard searches. Exploitation requires phishing the user to open the malicious link, and the attacker cannot exploit the vulnerability without user interaction.
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where an unauthenticated attacker can craft a malicious link to Analytics Workspace. If an authenticated user opens this link, the attacker-controlled Search Processing Language (SPL) commands execute with the user's permissions. This allows the attacker to access data and perform actions available to the user. The vulnerability arises from insufficient validation of data used to build searches in Analytics Workspace. Exploitation requires phishing to trick an authenticated user into opening the malicious link.
A vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows a low-privileged user without the fsh_manage capability to perform remote code execution via Federated Search bundle selection. This flaw arises because the Federated Search dispatch flow does not enforce capability checks on caller-controlled bundle selection, potentially compromising data access, system integrity, and availability.
Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14 contain a vulnerability where an unauthenticated user able to access the management port can inject a malicious Search Processing Language (SPL) pipeline. This pipeline executes when an administrator opens the Add Data forwarder workflow, potentially compromising data confidentiality, system integrity, and availability. The issue arises from improper neutralization of special characters in Deployment Server client identifiers used in dispatched searches. Exploitation requires the attacker to register a crafted Deployment Server client identity and an administrator to trigger the workflow.
CVE-2026-76399 is a high-severity vulnerability in Splunk AI Toolkit versions 6.0 and 6.0.0, where users with the "power" Splunk role can modify scheduled searches provided by the app to execute arbitrary Search Processing Language (SPL) queries with the permissions of the search owner. This flaw allows unauthorized access to sensitive data and can compromise system integrity.
CVE-2026-76350 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows users with the schedule_search capability to configure PDF attachments in email alert workflows that execute arbitrary SPL commands with system-level privileges. This occurs because the search scheduler incorrectly uses a system-level authentication context instead of the action owner's context when rendering PDF attachments, potentially exposing sensitive data and impacting system integrity and availability.
CVE-2026-76349 is a vulnerability in Splunk Enterprise versions prior to 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker to trick an authenticated user into executing arbitrary Search Processing Language (SPL) commands via a crafted Splunk Web link. This occurs because Splunk Web improperly handles form token values from URLs, failing to neutralize special elements that can alter query logic. Exploitation requires user interaction through phishing. The vulnerability is fixed in Splunk Enterprise 10.2.6 and later versions.
CVE-2026-76341 is a medium severity vulnerability in Splunk Enterprise that affects versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" role to store malicious Search Processing Language (SPL) in a Table Editor dataset, which is then executed with the permissions of an "admin" user who opens the dataset. This can lead to unauthorized data exposure and limited data modification on the search head. Exploitation requires phishing the admin user to trigger the SPL execution within their browser. The vulnerability arises because the Table Editor does not apply SPL safeguards for risky commands when preparing initial dataset data.
CVE-2026-76339 is a command injection vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user without admin or power roles to inject arbitrary SPL commands via the geostats command. The injected commands execute with the permissions of another authenticated user who initiates the attacker-controlled search, potentially exposing sensitive data and allowing modification of lookup files. Exploitation requires phishing the targeted user to initiate the malicious search in their browser. The vulnerability arises from insufficient input validation in the geostats command.