Salesforce
36 CVEs across 16 Salesforce products. Browse Salesforce vulnerabilities, severities, and proof-of-concept exploits.
Salesforce products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34951 | Medium | 6.1 | 2026-04-06 | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbenc… |
CVE-2026-2298 | Critical | 9.4 | 2026-03-23 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services P… |
CVE-2026-22586 | Critical | 9.8 | 2026-01-24 | Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsu… |
CVE-2026-22585 | Critical | 9.8 | 2026-01-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subsc… |
CVE-2026-22583 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module… |
CVE-2026-22582 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module)… |
CVE-2026-22584 | Critical | 9.8 | 2026-01-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Ex… |
CVE-2025-64322 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files… |
CVE-2025-64321 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration File… |
CVE-2025-64320 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentfo… |
CVE-2025-64319 | Medium | 5.3 | 2025-11-04 | Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fi… |
CVE-2025-64318 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration… |
CVE-2025-10875 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mul… |
CVE-2025-9844 | High | 8.8 | 2025-09-23 | Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: bef… |
CVE-2025-52451 | High | 8.5 | 2025-08-22 | Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolu… |
CVE-2025-52450 | Medium | 6.5 | 2025-08-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create… |
CVE-2025-26498 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Abso… |
CVE-2025-26497 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Travers… |
CVE-2025-26496 | Critical | 9.3 | 2025-08-22 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload module… |
CVE-2025-52455 | Medium | 5.3 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This is… |
CVE-2025-52454 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing… |
CVE-2025-52453 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. T… |
CVE-2025-52452 | High | 8.5 | 2025-07-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - dupli… |
CVE-2025-52449 | High | 8.5 | 2025-07-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alter… |
CVE-2025-52448 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interfa… |
CVE-2025-52447 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows I… |
CVE-2025-52446 | High | 8.0 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulati… |
CVE-2025-43701 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: bef… |
CVE-2025-43700 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Sp… |
CVE-2025-43699 | Medium | 5.3 | 2025-06-10 | Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts O… |
CVE-2025-43698 | Critical | 9.1 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects… |
CVE-2025-43697 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spr… |
CVE-2025-26495 | High | 7.5 | 2025-02-11 | Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This… |
CVE-2025-26494 | High | 7.7 | 2025-02-11 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 throu… |
CVE-2024-32148 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0. |
CVE-2023-26136 | Medium | 6.5 | 2023-07-01 | Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPubli… |
CVE-2016-15012 | Medium | 5.5 | 2023-01-07 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affec… |
CVE-2021-1630 | High | 7.5 | 2021-08-05 | XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Clou… |
CVE-2021-1628 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-prem… |
CVE-2021-1627 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-pr… |
CVE-2021-1626 | Critical | 9.8 | 2021-03-26 | MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise… |
CVE-2016-1000232 | Medium | 5.3 | 2018-09-05 | NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Servic… |
CVE-2017-15010 | High | 7.5 | 2017-10-04 | A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP req… |