Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (36 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-34951 2 Forceworkbench, Salesforce 2 Forceworkbench, Workbench 2026-04-15 6.1 Medium
Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.
CVE-2025-9844 2 Microsoft, Salesforce 2 Windows, Cli 2026-04-15 8.8 High
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.
CVE-2024-39344 1 Salesforce 1 Docusign Api Package For Salesforce 2026-04-15 8.1 High
An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromised. With the default settings when installed for all users, the object can be accessible and (via its fields) could disclose some keys. These disclosed components can be combined to create a valid session via the Docusign API. This will generally lead to a complete compromise of the Docusign account because the session is for an administrator service account and may have permission to re-authenticate as specific users with the same authorization flow.
CVE-2026-2298 1 Salesforce 1 Marketing Cloud Engagement 2026-03-25 9.4 Critical
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.
CVE-2025-52454 4 Linux, Microsoft, Salesforce and 1 more 4 Linux Kernel, Windows, Tableau Server and 1 more 2026-03-23 8.2 High
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-52449 4 Linux, Microsoft, Salesforce and 1 more 4 Linux Kernel, Windows, Tableau Server and 1 more 2026-02-26 8.5 High
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-26496 4 Linux, Microsoft, Salesforce and 1 more 6 Linux, Windows, Tableau Desktop and 3 more 2026-02-26 9.3 Critical
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2026-22585 1 Salesforce 1 Marketing Cloud Engagement 2026-02-26 9.8 Critical
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
CVE-2026-22586 1 Salesforce 1 Marketing Cloud Engagement 2026-02-26 9.8 Critical
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
CVE-2026-22582 1 Salesforce 1 Marketing Cloud Engagement 2026-02-26 9.8 Critical
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
CVE-2026-22583 1 Salesforce 1 Marketing Cloud Engagement 2026-02-26 9.8 Critical
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
CVE-2025-10875 1 Salesforce 2 Mulesoft, Mulesoft Anypoint Code Builder 2026-02-04 6.5 Medium
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6.
CVE-2025-64318 1 Salesforce 2 Mulesoft, Mulesoft Anypoint Code Builder 2026-02-04 5.3 Medium
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1.
CVE-2025-64319 1 Salesforce 2 Mulesoft, Mulesoft Anypoint Code Builder 2026-02-04 5.3 Medium
Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1
CVE-2025-64320 1 Salesforce 2 Agentforce Vibes, Agentforce Vibes Extension 2026-02-04 6.5 Medium
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0.
CVE-2025-64321 1 Salesforce 2 Agentforce Vibes, Agentforce Vibes Extension 2026-02-04 5.3 Medium
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.
CVE-2025-64322 1 Salesforce 2 Agentforce Vibes, Agentforce Vibes Extension 2026-02-04 5.3 Medium
Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.
CVE-2026-22584 1 Salesforce 1 Uni2ts 2026-01-22 9.8 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.
CVE-2025-26497 4 Linux, Microsoft, Salesforce and 1 more 5 Linux, Linux Kernel, Windows and 2 more 2025-11-06 7.3 High
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-26498 4 Linux, Microsoft, Salesforce and 1 more 4 Linux, Windows, Tableau Server and 1 more 2025-11-03 7.3 High
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.