CVEs.
Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.
NVD data refreshed 17 min ago
Severity of matching CVEs
CVSS base severity, as scored in NVD
- Critical
- 00%
- High
- 16100%
- Medium
- 00%
- Low or not scored
- 00%
- Matching CVEs
- 16
- Last two years
- Critical
- 0
- CVSS 9.0 and above
- High
- 16
- CVSS 7.0 to 8.9
- Known exploited
- 0
- On CISA's KEV list
Matching CVEs published
By month, last two years
Peak 7 · July 2025
- Total: 16
- December 2024: 0
- January 2025: 0
- February 2025: 2
- March 2025: 0
- April 2025: 0
- May 2025: 0
- June 2025: 3
- July 2025: 7
- August 2025: 3
- September 2025: 1
- October 2025: 0
- November 2025: 0
- December 2025: 0
- January 2026: 0
- February 2026: 0
- March 2026: 0
- April 2026: 0
- May 2026: 0
- June 2026: 0
- July 2026: 0
- August 2026: 0
- September 2026: 0
- October 2026: 0
- November 2026: 0
Most CVEs
In each company's software, last two years
Matching CVEs
- 8.8High
CVE-2025-9844 (opens in a new tab)
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.
Salesforce· Sep 23, 2025
- 8.5High
CVE-2025-52451 (opens in a new tab)
Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Aug 22, 2025
- 7.3High
CVE-2025-26498 (opens in a new tab)
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Aug 22, 2025
- 7.3High
CVE-2025-26497 (opens in a new tab)
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Aug 22, 2025
- 8.2High
CVE-2025-52454 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.2High
CVE-2025-52453 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.5High
CVE-2025-52452 (opens in a new tab)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.5High
CVE-2025-52449 (opens in a new tab)
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.1High
CVE-2025-52448 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.1High
CVE-2025-52447 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 8.0High
CVE-2025-52446 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
- 7.5High
CVE-2025-43701 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
Salesforce· Jun 10, 2025
- 7.5High
CVE-2025-43700 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.
Salesforce· Jun 10, 2025
- 7.5High
CVE-2025-43697 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025
Salesforce· Jun 10, 2025
- 7.5High
CVE-2025-26495 (opens in a new tab)
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
Salesforce· Feb 11, 2025
- 7.7High
CVE-2025-26494 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.
Salesforce· Feb 11, 2025
Public information only
Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.
Sources
- National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
- CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag
How fresh it is
- New and changed CVEs: pulled from NVD every two hours; last run 17 min ago
- Known-exploited flags: updated from CISA in the same run
- Window: the last two years; older entries drop off automatically
Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.
statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.