# cve.now: Salesforce

The newest entries naming Salesforce as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-2298](https://cve.now/CVE-2026-2298.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement al (CVSS 9.4)
- [CVE-2026-22583](https://cve.now/CVE-2026-22583.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (C (CVSS 9.8)
- [CVE-2026-22582](https://cve.now/CVE-2026-22582.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (M (CVSS 9.8)
- [CVE-2026-22586](https://cve.now/CVE-2026-22586.md): Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscr (CVSS 9.8)
- [CVE-2026-22585](https://cve.now/CVE-2026-22585.md): Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Pr (CVSS 9.8)
- [CVE-2026-22584](https://cve.now/CVE-2026-22584.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Execut (CVSS 9.8)
- [CVE-2025-64322](https://cve.now/CVE-2025-64322.md): Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable C (CVSS 5.3)
- [CVE-2025-64321](https://cve.now/CVE-2025-64321.md): Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable (CVSS 5.3)
- [CVE-2025-64320](https://cve.now/CVE-2025-64320.md): Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This is (CVSS 6.5)
- [CVE-2025-64319](https://cve.now/CVE-2025-64319.md): Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeab (CVSS 5.3)
- [CVE-2025-64318](https://cve.now/CVE-2025-64318.md): Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Write (CVSS 5.3)
- [CVE-2025-10875](https://cve.now/CVE-2025-10875.md): Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.Thi (CVSS 6.5)
- [CVE-2025-9844](https://cve.now/CVE-2025-9844.md): Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects (CVSS 8.8)
- [CVE-2025-52451](https://cve.now/CVE-2025-52451.md): Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload mod (CVSS 8.5)
- [CVE-2025-52450](https://cve.now/CVE-2025-52450.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (CVSS 6.5)
- [CVE-2025-26498](https://cve.now/CVE-2025-26498.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo m (CVSS 7.3)
- [CVE-2025-26497](https://cve.now/CVE-2025-26497.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Ab (CVSS 7.3)
- [CVE-2025-26496](https://cve.now/CVE-2025-26496.md): Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (CVSS 9.3)
- [CVE-2025-52455](https://cve.now/CVE-2025-52455.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Locatio (CVSS 5.3)
- [CVE-2025-52454](https://cve.now/CVE-2025-52454.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resourc (CVSS 8.2)
- [CVE-2025-52453](https://cve.now/CVE-2025-52453.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource L (CVSS 8.2)
- [CVE-2025-52452](https://cve.now/CVE-2025-52452.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (CVSS 8.5)
- [CVE-2025-52449](https://cve.now/CVE-2025-52449.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service mo (CVSS 8.5)
- [CVE-2025-52448](https://cve.now/CVE-2025-52448.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modu (CVSS 8.1)
- [CVE-2025-52447](https://cve.now/CVE-2025-52447.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc comman (CVSS 8.1)
- [CVE-2025-52446](https://cve.now/CVE-2025-52446.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows I (CVSS 8.0)
- [CVE-2025-43699](https://cve.now/CVE-2025-43699.md): Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission chec (CVSS 5.3)
- [CVE-2025-43698](https://cve.now/CVE-2025-43698.md): Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for S (CVSS 9.1)
- [CVE-2025-43697](https://cve.now/CVE-2025-43697.md): Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. (CVSS 7.5)
- [CVE-2025-43701](https://cve.now/CVE-2025-43701.md): Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. (CVSS 7.5)
- [CVE-2025-43700](https://cve.now/CVE-2025-43700.md): Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. (CVSS 7.5)
- [CVE-2025-26495](https://cve.now/CVE-2025-26495.md): Sensitive Data Exposure in Tableau Server (CVSS 7.5)
- [CVE-2025-26494](https://cve.now/CVE-2025-26494.md): Server Side Request Forgery vulnerability in Tableau Server (CVSS 7.7)
- [CVE-2024-32148](https://cve.now/CVE-2024-32148.md): WordPress Pardot plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2019-15630](https://cve.now/CVE-2019-15630.md): Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before Augu (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/salesforce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.