Splunk vulnerabilities1 known to be exploited.
Splunk has 238 published vulnerabilities across 15 products in our catalogue. 1 of them is on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Splunk, with 166. If you run Splunk software, patch the exploited flaws first.
The most recent Splunk flaw added to the known-exploited list is CVE-2014-0160, on 4 May 2022. We keep watching the known-exploited list.
Which Splunk products have the most vulnerabilities?
Splunk leads with 166 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Splunk vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.5OpenSSL Information Disclosure Vulnerability
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Which Splunk flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via...
- 98%CVE-2018-11409Medium
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
- 89%CVE-2023-46214High
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply.
- 79%CVE-2023-32707High
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can...
- 64%CVE-2021-22901High
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
- 43%CVE-2023-32714High
In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted...
- 43%CVE-2022-43568Medium
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.
- 36%CVE-2022-32206Medium
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms.
- 31%CVE-2022-32205Medium
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.
- 29%CVE-2025-20297Medium
In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk...
All Splunk products we track.
13 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Splunksplunk166 vulnerabilities288 versions
- Splunk Cloud Platformsplunk_cloud_platform77 vulnerabilities67 versions
- Universal Forwarderuniversal_forwarder61 vulnerabilities47 versions
- Cloudcloud9 vulnerabilities8 versions
- Add-on Builderadd-on_builder3 vulnerabilities4 versions
- Splunk App for Lookup File Editingsplunk_app_for_lookup_file_editing3 vulnerabilities1 version
- Enterprise Securityenterprise_security2 vulnerabilities3 versions
- Cloudconnect Software Development Kitcloudconnect_software_development_kit1 vulnerability3 versions
- IT Service Intelligenceit_service_intelligence1 vulnerability7 versions
- Nozzlenozzle1 vulnerability5 versions
- SOARsoar1 vulnerability3 versions
- Software Development Kitsoftware_development_kit1 vulnerability24 versions
- Splunk App for Streamsplunk_app_for_stream1 vulnerability1 version
This directory lists the 13 Splunk products with at least one tracked version, of 15 in our catalogue.
Running Splunk? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
- Matched to
- Splunk on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 238 published vulnerabilities across 15 products and 461 versions from Splunk. The most recent Splunk flaw added to the known-exploited list is CVE-2014-0160, on 4 May 2022.
1 Splunk vulnerability is on the list of flaws known to be exploited. The most recently added is CVE-2014-0160. The full list is on this page.
Splunk, with 166 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Splunk products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.