Question 1

How many vulnerabilities does Splunk have?

Accepted Answer

29 advisories in this record are tied by a register to a product of Splunk. That is not the same as the number of vulnerabilities the products contain, and no public source knows that number. It is the count of what has been found, disclosed and published, which depends on how much the products are examined and how openly the vendor discloses.

Question 2

Are any Splunk vulnerabilities being actively exploited?

Accepted Answer

1 of the 29 records here appears in the CISA catalogue of known exploited vulnerabilities, which lists flaws with confirmed exploitation in the wild. They are shown first in the list above. Whether any of them affects your deployment depends on the versions and components you run.

Question 3

Why does this page show fewer CVEs for Splunk than other sites?

Accepted Answer

Because a keyword search for a company name returns advisories about other companies' products that mention it in passing, and this page excludes those. 39 register entries name Splunk without naming one of its products as affected. A mirror that lists them produces a longer page and a wrong number.

Question 4

Where do the Splunk advisories on this page come from?

Accepted Answer

From European Vulnerability Database (ENISA, European Union); CERT-Bund security advisories (BSI, Federal Republic of Germany); Known Exploited Vulnerabilities catalogue (CISA, United States). Every entry links back to the register that published it, and carries the date that register states. Where the same vulnerability is held by several registers it is shown once with a link to each, rather than counted twice.

Question 5

Does a long advisory list mean Splunk is insecure?

Accepted Answer

No. A register records what researchers found and what the vendor disclosed, so a widely deployed product with a working disclosure process accumulates more entries than one nobody examines. A short list can equally mean a small install base or a vendor that publishes little. This page reports the record and does not rate the vendor, because whether this is acceptable depends on your risk appetite, your compliance scope and the alternatives you are weighing.

Register	Operated by	Entries	Latest
European Vulnerability Database	ENISA, European Union	40	Jul 15, 2026
CERT-Bund security advisories	BSI, Federal Republic of Germany	28	Jul 16, 2026
Known Exploited Vulnerabilities catalogue	CISA, United States	1	Jun 18, 2026

Splunk advisories: every record the registers tie to its products

Why this list is shorter than a CVE mirror

The full list, most recently exploited and most recent first

Which registers contributed

Questions this page answers

How many vulnerabilities does Splunk have?

Are any Splunk vulnerabilities being actively exploited?

Why does this page show fewer CVEs for Splunk than other sites?

Where do the Splunk advisories on this page come from?

Does a long advisory list mean Splunk is insecure?

A list of advisories is not a risk assessment