CveMateVulnerability intelligence

Salesforce vulnerabilities, page 2

43 vulnerabilities

Known vulnerabilities in Salesforce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.

CVE-2025-26497salesforcetableau server+11y ago22-08-2025 20:13

Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.CVE-2025-9844salesforcesalesforce cli1y ago23-09-2025 13:11

Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.CVE-2025-43699salesforceomnistudio1y ago10-06-2025 11:44

Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spring 2025 CVE-2025-43700salesforceomnistudio1y ago10-06-2025 11:12

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.CVE-2025-43698salesforceomnistudio1y ago10-06-2025 11:33

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025 CVE-2025-43701salesforceomnistudio1y ago10-06-2025 11:21

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.CVE-2025-43697salesforceomnistudio1y ago10-06-2025 11:28

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025 CVE-2025-10875salesforcemulesoft_anypoint_code_builder11mo ago04-11-2025 18:14

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6.CVE-2025-64318salesforcemulesoft_anypoint_code_builder11mo ago04-11-2025 18:19

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1.CVE-2025-64319salesforcemulesoft_anypoint_code_builder11mo ago04-11-2025 18:22

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1 CVE-2025-64322salesforceagentforce_vibes+111mo ago04-11-2025 18:33

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.CVE-2025-64320salesforceagentforce_vibes+111mo ago04-11-2025 18:27

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0.CVE-2025-64321salesforceagentforce_vibes+111mo ago04-11-2025 18:30

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.CVE-2017-15010debiannode-tough-cookie+49y ago03-10-2017 16:00

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.CVE-2024-32148salesforcepardot+12y ago11-06-2024 14:44

Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0.CVE-2026-2298salesforcemarketing_cloud_engagement7mo ago23-03-2026 19:54

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.CVE-2026-22586salesforcemarketing_cloud_engagement9mo ago24-01-2026 00:17

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.CVE-2026-22584PyPIuni2ts+19mo ago09-01-2026 22:10

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.CVE-2026-22583salesforcemarketing_cloud_engagement9mo ago24-01-2026 00:20

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.CVE-2026-22582salesforcemarketing_cloud_engagement9mo ago24-01-2026 00:19

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.