TS
Product
Tableau Server
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 4Low 0
Watch
Add Tableau Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-52451 | 8.5 | Aug 22 | Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52452 | 8.5 | Jul 25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52449 | 8.5 | Jul 25 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52454 | 8.2 | Jul 25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52453 | 8.2 | Jul 25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52448 | 8.1 | Jul 25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-52447 | 8.1 | Jul 25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2019-15637 | 8.1 | Aug 26 | Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS Affected: 10.5 through 10.5.18; 2018.1 through 2018.1.15; 2018.2 through 2018.12; 2018.3 through 2018.3.9; 2019.1 through 2019.1.6; 2019.2 through 2019.2.2; +9 more |
| CVE-2025-52446 | 8.0 | Jul 25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-26494 | 7.7 | Feb 11 | Server Side Request Forgery vulnerability in Tableau Server Affected: 2023.3 through 2023.3.5 |
| CVE-2025-26495 | 7.5 | Feb 11 | Sensitive Data Exposure in Tableau Server Affected: 2020.4 before 2020.4.19; 2021.1 before 2021.1.16; 2021.2 before 2021.2.14; 2021.3 before 2021.3.13; 2021.4 before 2021.4.8; 2022.1 before 2022.1.3 |
| CVE-2020-6938 | 7.5 | Jul 8 | A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log… Affected: 2018.1 through 2020.2; 10.5 |
| CVE-2025-26498 | 7.3 | Aug 22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2025-26497 | 7.3 | Aug 22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue… Affected: before 2023.3.19; 2024.2 before 2024.2.12; 2025.1 before 2025.1.3 |
| CVE-2022-22127 | 7.2 | May 25 | Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users Affected: 2020.4 through 2020.4.16; 2021.1 through 2021.1.13; 2021.2 through 2021.2.10; 2021.3 through 2021.3.9; 2021.4 through 2021.4.4 |
Showing 15