https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:11:35 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1281 certfr-2026-avi-1281 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1281 https://vulnerability.circl.lu/vuln/fkie_cve-2026-76268 <p>In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.</p> <p>Splunk Enterprise versions 10.0.x and 9.4.x are not affected.</p> <p>In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.</p> <p>Splunk Enterprise versions 10.0.x and 9.4.x are not affected.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-76268 https://vulnerability.circl.lu/vuln/ghsa-rxjh-rj2v-47gx <p>In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.</p> <p>Splunk Enterprise versions 10.0.x and 9.4.x are not affected.</p> <p>In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.</p> <p>Splunk Enterprise versions 10.0.x and 9.4.x are not affected.</p> https://vulnerability.circl.lu/vuln/ghsa-rxjh-rj2v-47gx