CVE-2026-20296

Splunk Fixes Three Splunk Enterprise Vulnerabilities Led by CVE-2026-20296 CSRF Flaw

Do Son July 16, 2026

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296,...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-94504CVSS 7.2
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the...
Admin intel📅 Updated: Oct 7, 2026
CVE-2026-93836CVSS 7.2
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \'qty\'...
Admin intel📅 Updated: Oct 7, 2026
CVE-2026-21589CVSS 9.3
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software...
Admin intel📅 Updated: Oct 7, 2026
CVE-2026-61500CVSS 9.3
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs...
Admin intel📅 Updated: Oct 7, 2026
CVE-2026-88779CVSS 8.7
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS,...
Admin intelCISA KEV📅 Added to KEV: Oct 4, 2026📅 Updated: Oct 4, 2026
CVE-2026-102490CVSS 8.5
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Admin intelCISA KEV📅 Added to KEV: Oct 2, 2026📅 Updated: Oct 2, 2026
CVE-2026-102489CVSS 8.7
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as...
Admin intelCISA KEV📅 Added to KEV: Oct 2, 2026📅 Updated: Oct 2, 2026
CVE-2026-100382CVSS 10.0
Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') vulnerability in Wikimedia Foundation Mediawiki...
Admin intel📅 Updated: Oct 1, 2026

CVE-2026-9209CVSS 9.3
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the...
📅 Updated: Oct 8, 2026
CVE-2026-95606CVSS 9.8
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue...
📅 Updated: Oct 8, 2026
CVE-2026-95605CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP...
📅 Updated: Oct 8, 2026
CVE-2026-85097CVSS 9.8
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including,...
📅 Updated: Oct 8, 2026
CVE-2026-17609CVSS 9.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion...
📅 Updated: Oct 8, 2026
CVE-2022-37897CVSS 9.8
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted...
📅 Updated: Oct 8, 2026
CVE-2026-105110CVSS 9.3
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote...
📅 Updated: Oct 8, 2026
CVE-2026-61447CVSS 10.0
### Summary `CodeAgent._execute_python()` executes LLM-generated Python code in a subprocess with the complete parent-process environment (`os.environ.copy()`), zero AST...
📅 Updated: Oct 8, 2026