Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,821All CVEsplus 19,115 rejected
- 501Last 24 hours2,910 in the last 7 days
- 16,816Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 110 |
| 2025 | 0 | 0 | 2 | 0 | 0 | 2 | 110 |
| 2024 | 0 | 14 | 26 | 1 | 0 | 41 | 108 |
| 2023 | 0 | 19 | 17 | 0 | 0 | 36 | 67 |
| 2022 | 1 | 22 | 6 | 2 | 0 | 31 | 31 |
| Title | ||
|---|---|---|
| CVE-2025-0367 | Regular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)Splunk · Splunk Supporting Add-on for Active Directory | Medium6.5 |
| CVE-2025-22621 | Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOARSplunk · Splunk App for SOAR | Medium6.4 |
| CVE-2024-53244 | Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameterSplunk · Splunk Enterprise | Medium5.7 |
| CVE-2024-53246 | Sensitive Information Disclosure through SPL commandsSplunk · Splunk Enterprise | Medium5.3 |
| CVE-2024-53243 | Information Disclosure in Mobile Alert Responses in Splunk Secure GatewaySplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-53245 | Information Disclosure due to Username Collision with a Role that has the same Name as the UserSplunk · Splunk Enterprise | Low3.1 |
| CVE-2024-53247 | Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway appSplunk · Splunk Enterprise | High8.8 |
| CVE-2024-45739 | Sensitive information disclosure in AdminManager logging channelSplunk · Splunk Enterprise | Medium4.9 |
| CVE-2024-45738 | Sensitive information disclosure in REST_Calls logging channelSplunk · Splunk Enterprise | Medium4.9 |
| CVE-2024-45737 | Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)Splunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-45733 | Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on WindowsSplunk · Splunk Enterprise | High8.8 |
| CVE-2024-45732 | Low-privileged user could run search as nobody in SplunkDeploymentServerConfig appSplunk · Splunk Enterprise | High7.1 |
| CVE-2024-45736 | Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonSplunk · Splunk Enterprise | Medium6.5 |
| CVE-2024-45741 | Persistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseSplunk · Splunk Enterprise | Medium5.4 |
| CVE-2024-45734 | Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic DashboardSplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-45740 | Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk EnterpriseSplunk · Splunk Enterprise | Medium5.4 |
| CVE-2024-45731 | Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate diskSplunk · Splunk Enterprise | High8.0 |
| CVE-2024-45735 | Improper Access Control for low-privileged user in Splunk Secure Gateway AppSplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-36997 | Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpointSplunk · Splunk Enterprise | Medium4.6 |
| CVE-2024-36993 | Persistent Cross-site Scripting (XSS) in Web BulletinSplunk · Splunk Enterprise | Medium5.4 |
| CVE-2024-36995 | Low-privileged user could create experimental itemsSplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-36982 | Denial of Service through null pointer reference in “cluster/config” REST endpointSplunk · Splunk Enterprise | High7.5 |
| CVE-2024-36991 | Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on WindowsSplunk · Splunk Enterprise | High7.5 |
| CVE-2024-36990 | Denial of Service (DoS) on the datamodel/web REST endpointSplunk · Splunk Enterprise | Medium6.5 |
| CVE-2024-36985 | Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk EnterpriseSplunk · Splunk Enterprise | High8.8 |
| CVE-2024-36992 | Persistent Cross-site Scripting (XSS) in Dashboard ElementsSplunk · Splunk Enterprise | Medium5.4 |
| CVE-2024-36984 | Remote Code Execution through Serialized Session Payload in Splunk Enterprise on WindowsSplunk · Splunk Enterprise | High8.8 |
| CVE-2024-36986 | Risky command safeguards bypass through Search ID query in Analytics WorkspaceSplunk · Splunk Enterprise | Medium6.3 |
| CVE-2024-36983 | Command Injection using External LookupsSplunk · Splunk Enterprise | High8.0 |
| CVE-2024-36996 | Information Disclosure of user namesSplunk · Splunk Enterprise | Medium5.3 |
| CVE-2024-36994 | Persistent Cross-site Scripting (XSS) in Dashboard ElementsSplunk · Splunk Enterprise | Medium5.4 |
| CVE-2024-36989 | Low-privileged user could create notifications in Splunk Web Bulletin MessagesSplunk · Splunk Enterprise | Medium6.5 |
| CVE-2024-36987 | Insecure File Upload in the indexing/preview REST endpointSplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-29945 | Splunk Authentication Token Exposure in Debug Log in Splunk EnterpriseSplunk · Splunk Enterprise | High7.2 |
| CVE-2024-29946 | Risky command safeguards bypass in Dashboard Examples HubSplunk · Splunk Enterprise | High8.1 |
| CVE-2023-46230 | Sensitive Information Disclosure to Internal Log Files in Splunk Add-on BuilderSplunk · Splunk Add-on Builder | High8.2 |
| CVE-2023-46231 | Session Token Disclosure to Internal Log Files in Splunk Add-on BuilderSplunk · Splunk Add-on Builder | High8.8 |
| CVE-2024-23678 | Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk PartitionSplunk · Splunk Enterprise | High7.5 |
| CVE-2024-23676 | Sensitive Information Disclosure of Index Metrics through “mrollup” SPL CommandSplunk · Splunk Enterprise | Medium4.6 |
| CVE-2024-23677 | Server Response Disclosure in RapidDiag Salesforce.com Log FileSplunk · Splunk Enterprise | Medium4.3 |
| CVE-2024-23675 | Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection DeletionSplunk · Splunk Enterprise | Medium6.5 |
| CVE-2024-22164 | Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachmentsSplunk · Splunk Enterprise Security (ES) | Medium4.3 |
| CVE-2024-22165 | Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creationSplunk · Splunk Enterprise Security (ES) | Medium6.5 |
| CVE-2023-46213 | Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search PageSplunk · Splunk Enterprise | Medium4.8 |
| CVE-2023-46214 | Remote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingSplunk · Splunk Enterprise | High8.0 |
| CVE-2023-40597 | Absolute Path Traversal in Splunk Enterprise Using runshellscript.pySplunk · Splunk Enterprise | High7.8 |
| CVE-2023-40596 | Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLLSplunk · Splunk Enterprise | High7.0 |
| CVE-2023-40593 | Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML RequestSplunk · Splunk Enterprise | Medium6.3 |
| CVE-2023-40594 | Denial of Service (DoS) via the ‘printf’ Search FunctionSplunk · Splunk Enterprise | Medium6.5 |
| CVE-2023-4571 | Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)Splunk · Splunk ITSI | High8.6 |