CVE Program partner

Salesforce

Salesforce, Inc.

API
CVEs, 365 days1245 all time, 0 rejected
Quality66%median 99%
CVSS by the CNA0%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA100%lower is better
OrganisationSalesforce, Inc.
RoleCNA
TypeVendor
Reports tomitre
Scope<a href='https://trust.salesforce.com/en/trust-and-compliance-documentation/' target='_blank'>Salesforce products</a> only.
Advisorieshttps://trust.salesforce.com/en/security/security-advisories/

Latest CVEs · RSS

  • CVE-2026-2298 2026-03-23
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Pr
  • CVE-2026-22583 2026-01-24
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module)
  • CVE-2026-22582 2026-01-24
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module)
  • CVE-2026-22586 2026-01-24
    Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub
  • CVE-2026-22585 2026-01-24
    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscr
  • CVE-2026-22584 2026-01-09
    Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Exe
  • CVE-2025-64322 2025-11-04
    Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.T
  • CVE-2025-64321 2025-11-04
    Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files
  • CVE-2025-64320 2025-11-04
    Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentfor
  • CVE-2025-64319 2025-11-04
    Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Fil
  • CVE-2025-64318 2025-11-04
    Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration F
  • CVE-2025-10875 2025-11-04
    Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mule
  • CVE-2025-9844 2025-09-23
    Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: befo
  • CVE-2025-52451 2025-08-22
    Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolut
  • CVE-2025-52450 2025-08-22
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-
  • CVE-2025-26498 2025-08-22
    Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absol
  • CVE-2025-26497 2025-08-22
    Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversa
  • CVE-2025-26496 2025-08-22
    Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules
  • CVE-2025-52455 2025-07-25
    Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This iss
  • CVE-2025-52454 2025-07-25
    Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing.
  • CVE-2025-52453 2025-07-25
    Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. Th
  • CVE-2025-52452 2025-07-25
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplic
  • CVE-2025-52449 2025-07-25
    Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Altern
  • CVE-2025-52448 2025-07-25
    Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interfac
  • CVE-2025-52447 2025-07-25
    Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows In

All CVE Program partners