https://vulnogram.org/ Most recent CVEs assigned by Salesforce, Inc. (salesforce). https://vulnogram.org/seaview/icons/salesforce.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-2298 https://vulnogram.org/CVE-2026-2298 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2… Critical Network Exploitable Mon, 23 Mar 2026 19:54:32 GMT https://vulnogram.org/CVE-2026-22583 https://vulnogram.org/CVE-2026-22583 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement:… Critical Network Exploitable Sat, 24 Jan 2026 00:20:54 GMT https://vulnogram.org/CVE-2026-22582 https://vulnogram.org/CVE-2026-22582 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement:… Critical Network Exploitable Sat, 24 Jan 2026 00:19:26 GMT https://vulnogram.org/CVE-2026-22586 https://vulnogram.org/CVE-2026-22586 Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue af… Critical Network Exploitable Sat, 24 Jan 2026 00:17:08 GMT https://vulnogram.org/CVE-2026-22585 https://vulnogram.org/CVE-2026-22585 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipul… Critical Network Exploitable Sat, 24 Jan 2026 00:15:02 GMT https://vulnogram.org/CVE-2026-22584 https://vulnogram.org/CVE-2026-22584 Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0. Critical Network Exploitable Fri, 09 Jan 2026 22:10:02 GMT https://vulnogram.org/CVE-2025-64322 https://vulnogram.org/CVE-2025-64322 Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. Medium Network Exploitable Tue, 04 Nov 2025 18:33:19 GMT https://vulnogram.org/CVE-2025-64321 https://vulnogram.org/CVE-2025-64321 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. Medium Network Exploitable Tue, 04 Nov 2025 18:30:39 GMT https://vulnogram.org/CVE-2025-64320 https://vulnogram.org/CVE-2025-64320 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0. Medium Network Exploitable Tue, 04 Nov 2025 18:27:32 GMT https://vulnogram.org/CVE-2025-64319 https://vulnogram.org/CVE-2025-64319 Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1 Medium Network Exploitable Tue, 04 Nov 2025 18:22:51 GMT https://vulnogram.org/CVE-2025-64318 https://vulnogram.org/CVE-2025-64318 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1. Medium Network Exploitable Tue, 04 Nov 2025 18:19:33 GMT https://vulnogram.org/CVE-2025-10875 https://vulnogram.org/CVE-2025-10875 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6. Medium Network Exploitable Tue, 04 Nov 2025 18:14:28 GMT https://vulnogram.org/CVE-2025-9844 https://vulnogram.org/CVE-2025-9844 Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6. High Tue, 23 Sep 2025 13:11:31 GMT https://vulnogram.org/CVE-2025-52451 https://vulnogram.org/CVE-2025-52451 Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, bef… High Fri, 22 Aug 2025 20:20:12 GMT https://vulnogram.org/CVE-2025-52450 https://vulnogram.org/CVE-2025-52450 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Ta… Medium Fri, 22 Aug 2025 20:18:19 GMT https://vulnogram.org/CVE-2025-26498 https://vulnogram.org/CVE-2025-26498 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, b… High Network Exploitable Fri, 22 Aug 2025 20:16:04 GMT https://vulnogram.org/CVE-2025-26497 https://vulnogram.org/CVE-2025-26497 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. High Network Exploitable Fri, 22 Aug 2025 20:13:13 GMT https://vulnogram.org/CVE-2025-26496 https://vulnogram.org/CVE-2025-26496 Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2… Critical Fri, 22 Aug 2025 20:10:41 GMT https://vulnogram.org/CVE-2025-52455 https://vulnogram.org/CVE-2025-52455 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Medium Network Exploitable Fri, 25 Jul 2025 19:11:47 GMT https://vulnogram.org/CVE-2025-52454 https://vulnogram.org/CVE-2025-52454 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. High Fri, 25 Jul 2025 19:08:59 GMT https://vulnogram.org/CVE-2025-52453 https://vulnogram.org/CVE-2025-52453 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. High Fri, 25 Jul 2025 19:05:50 GMT https://vulnogram.org/CVE-2025-52452 https://vulnogram.org/CVE-2025-52452 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server… High Fri, 25 Jul 2025 19:00:05 GMT https://vulnogram.org/CVE-2025-52449 https://vulnogram.org/CVE-2025-52449 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: befor… High Fri, 25 Jul 2025 18:56:25 GMT https://vulnogram.org/CVE-2025-52448 https://vulnogram.org/CVE-2025-52448 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tablea… High Fri, 25 Jul 2025 18:53:39 GMT https://vulnogram.org/CVE-2025-52447 https://vulnogram.org/CVE-2025-52447 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects… High Fri, 25 Jul 2025 18:50:03 GMT https://vulnogram.org/CVE-2025-52446 https://vulnogram.org/CVE-2025-52446 Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: befo… High Fri, 25 Jul 2025 18:43:13 GMT https://vulnogram.org/CVE-2025-43699 https://vulnogram.org/CVE-2025-43699 Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spring 2025 Medium Network Exploitable Tue, 10 Jun 2025 11:44:01 GMT https://vulnogram.org/CVE-2025-43698 https://vulnogram.org/CVE-2025-43698 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025 Critical Network Exploitable Tue, 10 Jun 2025 11:33:08 GMT https://vulnogram.org/CVE-2025-43697 https://vulnogram.org/CVE-2025-43697 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025 High Network Exploitable Tue, 10 Jun 2025 11:28:58 GMT https://vulnogram.org/CVE-2025-43701 https://vulnogram.org/CVE-2025-43701 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254. High Network Exploitable Tue, 10 Jun 2025 11:21:57 GMT https://vulnogram.org/CVE-2025-43700 https://vulnogram.org/CVE-2025-43700 Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025. High Network Exploitable Tue, 10 Jun 2025 11:12:53 GMT https://vulnogram.org/CVE-2025-26495 https://vulnogram.org/CVE-2025-26495 Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2… High Network Exploitable Tue, 11 Feb 2025 17:56:38 GMT https://vulnogram.org/CVE-2025-26494 https://vulnogram.org/CVE-2025-26494 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5. High Tue, 11 Feb 2025 17:33:53 GMT https://vulnogram.org/CVE-2022-22128 https://vulnogram.org/CVE-2022-22128 Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau only supports product versions for 24 months after release. Older versions… Critical Network Exploitable Mon, 17 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-22127 https://vulnogram.org/CVE-2022-22127 Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for user… Wed, 25 May 2022 13:56:52 GMT https://vulnogram.org/CVE-2021-1630 https://vulnogram.org/CVE-2021-1630 XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers. Thu, 05 Aug 2021 20:29:15 GMT https://vulnogram.org/CVE-2021-1629 https://vulnogram.org/CVE-2021-1629 Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users. Fri, 26 Mar 2021 16:20:28 GMT https://vulnogram.org/CVE-2021-1628 https://vulnogram.org/CVE-2021-1628 MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021. Fri, 26 Mar 2021 16:19:39 GMT https://vulnogram.org/CVE-2021-1627 https://vulnogram.org/CVE-2021-1627 MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 202… Fri, 26 Mar 2021 16:17:53 GMT https://vulnogram.org/CVE-2021-1626 https://vulnogram.org/CVE-2021-1626 MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021… Fri, 26 Mar 2021 16:17:41 GMT https://vulnogram.org/CVE-2020-6939 https://vulnogram.org/CVE-2020-6939 Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configure Site-Specific SAML settings and could lead to account takeover for… Mon, 23 Nov 2020 16:16:25 GMT https://vulnogram.org/CVE-2020-6938 https://vulnogram.org/CVE-2020-6938 A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files. Wed, 08 Jul 2020 15:02:06 GMT https://vulnogram.org/CVE-2020-6937 https://vulnogram.org/CVE-2020-6937 A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion. Fri, 29 May 2020 21:27:33 GMT https://vulnogram.org/CVE-2019-15631 https://vulnogram.org/CVE-2019-15631 Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code. Critical Network Exploitable Mon, 02 Dec 2019 01:44:27 GMT https://vulnogram.org/CVE-2019-15630 https://vulnogram.org/CVE-2019-15630 Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft… Fri, 30 Aug 2019 16:56:14 GMT