Published file metadata, source observations, indicators, and research history in one bounded catalog.
30Reachable catalog records
2 / 2Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
splunk_advisoriesCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
30 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the edit_local_apps and install_apps capabilities could cause a legitimate app installation to write files outside the intended app directory, into $SPLUNK_HOME/etc/ and its subdirect
First reported Jul 15, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.The injection is possible because SOAR does not strip co
First reported Jun 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down lin
First reported Jun 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.
First reported Jul 15, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and higher.
First reported Aug 19, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could view stored credential hashes when they access the /servicesNS/-/-/storage/passwords REST endpoint through the |rest Search Processi
First reported Jul 15, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.