Threat database

32 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.4	EPSS 0.4%	CVE-2026-2298Salesforce Marketing Cloud Engagement · Argument Injection Critical9.4EPSS 0.4%2026-03-23CVE Database V5CVE-2026-2298 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026. EPSS 0.4%Vulnerability CWE-88	CVE Database V5	2026-03-23
Critical	9.8	EPSS 0.6%	CVE-2026-22583Salesforce Marketing Cloud Engagement · Argument Injection Critical9.8EPSS 0.6%2026-01-24CVE Database V5CVE-2026-22583 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026. EPSS 0.6%Vulnerability CWE-88	CVE Database V5	2026-01-24
Critical	9.8	EPSS 0.6%	CVE-2026-22582Salesforce Marketing Cloud Engagement · Argument Injection Critical9.8EPSS 0.6%2026-01-24CVE Database V5CVE-2026-22582 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026. EPSS 0.6%Vulnerability CWE-88	CVE Database V5	2026-01-24
Critical	9.8	EPSS 0.6%	CVE-2026-22586Salesforce Marketing Cloud Engagement · Hard-coded Cryptographic Key Critical9.8EPSS 0.6%2026-01-24CVE Database V5CVE-2026-22586 Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026. EPSS 0.6%Vulnerability CWE-321	CVE Database V5	2026-01-24
Critical	9.8	EPSS 0.4%	CVE-2026-22585Salesforce Marketing Cloud Engagement · Weak Cryptography Critical9.8EPSS 0.4%2026-01-24CVE Database V5CVE-2026-22585 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026. EPSS 0.4%Vulnerability CWE-327	CVE Database V5	2026-01-24
Critical	9.8	EPSS 0.4%	CVE-2026-22584Salesforce Uni2TS · Code Injection Critical9.8EPSS 0.4%2026-01-09CVE Database V5CVE-2026-22584 Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0. EPSS 0.4%Vulnerability CWE-94	CVE Database V5	2026-01-09
Medium	5.3	EPSS 0.2%	CVE-2025-64322Salesforce Agentforce Vibes Extension · Incorrect Permissions Medium5.3EPSS 0.2%2025-11-04CVE Database V5CVE-2025-64322 Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. EPSS 0.2%Vulnerability CWE-732	CVE Database V5	2025-11-04
Medium	5.3	EPSS 0.2%	CVE-2025-64321Salesforce Agentforce Vibes Extension · Improper Neutralization of Input Used for LLM Prompting Medium5.3EPSS 0.2%2025-11-04CVE Database V5CVE-2025-64321 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. EPSS 0.2%Vulnerability CWE-1427	CVE Database V5	2025-11-04
Medium	6.5	EPSS 0.2%	CVE-2025-64320Salesforce Agentforce Vibes Extension · Improper Neutralization of Input Used for LLM Prompting Medium6.5EPSS 0.2%2025-11-04CVE Database V5CVE-2025-64320 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0. EPSS 0.2%Vulnerability CWE-1427	CVE Database V5	2025-11-04
Medium	5.3	EPSS 0.2%	CVE-2025-64319Salesforce Mulesoft Anypoint Code Builder · Incorrect Permissions Medium5.3EPSS 0.2%2025-11-04CVE Database V5CVE-2025-64319 Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1 EPSS 0.2%Vulnerability CWE-732	CVE Database V5	2025-11-04
Medium	5.3	EPSS 0.2%	CVE-2025-64318Salesforce Mulesoft Anypoint Code Builder · Improper Neutralization of Input Used for LLM Prompting Medium5.3EPSS 0.2%2025-11-04CVE Database V5CVE-2025-64318 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1. EPSS 0.2%Vulnerability CWE-1427	CVE Database V5	2025-11-04
Medium	6.5	EPSS 0.2%	CVE-2025-10875Salesforce Mulesoft Anypoint Code Builder · Improper Neutralization of Input Used for LLM Prompting Medium6.5EPSS 0.2%2025-11-04CVE Database V5CVE-2025-10875 Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6. EPSS 0.2%Vulnerability CWE-1427	CVE Database V5	2025-11-04
High	8.8	EPSS 0.5%	CVE-2025-9844Salesforce CLI · Uncontrolled Search Path Element High8.8EPSS 0.5%2025-09-23CVE Database V5CVE-2025-9844 Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6. EPSS 0.5%Vulnerability CWE-427	CVE Database V5	2025-09-23
High	8.5	EPSS 0.2%	CVE-2025-52451Salesforce Tableau Server · Improper Input Validation High8.5EPSS 0.2%2025-08-22CVE Database V5CVE-2025-52451 Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.2%Vulnerability CWE-20	CVE Database V5	2025-08-22
Medium	6.5	EPSS 0.4%	CVE-2025-52450Salesforce Tableau Server · Path Traversal Medium6.5EPSS 0.4%2025-08-22CVE Database V5CVE-2025-52450 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.4%Vulnerability CWE-22	CVE Database V5	2025-08-22
High	7.3	EPSS 0.3%	CVE-2025-26498Salesforce Tableau Server · Unrestricted File Upload High7.3EPSS 0.3%2025-08-22CVE Database V5CVE-2025-26498 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-434	CVE Database V5	2025-08-22
High	7.3	EPSS 0.3%	CVE-2025-26497Salesforce Tableau Server · Unrestricted File Upload High7.3EPSS 0.3%2025-08-22CVE Database V5CVE-2025-26497 Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-434	CVE Database V5	2025-08-22
Critical	9.3	EPSS 0.2%	CVE-2025-26496Salesforce Tableau Server, Tableau Desktop · Type Confusion Critical9.3EPSS 0.2%2025-08-22CVE Database V5CVE-2025-26496 Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.2%Vulnerability CWE-843	CVE Database V5	2025-08-22
Medium	5.3	EPSS 0.4%	CVE-2025-52455Salesforce Tableau Server · Server-Side Request Forgery (SSRF) Medium5.3EPSS 0.4%2025-07-25CVE Database V5CVE-2025-52455 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.4%Vulnerability CWE-918	CVE Database V5	2025-07-25
High	8.2	EPSS 0.3%	CVE-2025-52454Salesforce Tableau Server · Server-Side Request Forgery (SSRF) High8.2EPSS 0.3%2025-07-25CVE Database V5CVE-2025-52454 Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. EPSS 0.3%Vulnerability CWE-918	CVE Database V5	2025-07-25

Page 1 of 2