Salesforce
24 CVEs tracked since 2025. Since Jun 2025, none of them reached CISA KEV.
Salesforce CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2025-06 | 5 | 0 |
| 2025-07 | 8 | 0 |
| 2025-08 | 5 | 0 |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | 6 | 0 |
Products
The products that kept showing up in Salesforce's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Salesforce.
- CVE-2026-34951Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions6.1
- CVE-2026-2298Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affec...9.4
- CVE-2026-22583Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipul...9.8
- CVE-2026-22582Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipula...9.8
- CVE-2026-22586Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) all...9.8
- CVE-2026-22585Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As ...9.8
- CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2...9.8
- CVE-2025-64322Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Ex...5.3
- CVE-2025-64321Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes ...5.3
- CVE-2025-64320Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0.6.5
- CVE-2025-64319Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoi...5.3
- CVE-2025-64318Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anyp...5.3
- CVE-2025-10875Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1....6.5
- CVE-2025-9844Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.8.8
- CVE-2025-52451Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects T...8.5
The record
- Peak rank
- #123 in Jul 2025
- Busiest month shown
- Jul 2025, 8 CVEs
- Months with a KEV entry
- 0 since Jun 2025
- Monthly snapshots
- 4 since 2025