Vendors / Coupa Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Coupa records in CISA KEV No Coupa vulnerabilities are listed in CISA KEV.
Priority LOW 37
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section.
CVSS 4.0 HIGH 8.4· Network · High privileges · No interaction · EPSS 0.00413 · Published 2026-11-04 · Fixed in 04/11/2024 CWE-918
Priority LOW 32
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform.
CVSS 4.0 HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00347 · Published 2026-11-04 · Fixed in 04/11/2026 CWE-1236
Priority LOW 24
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00463 · Published 2026-11-04 · Fixed in 04/11/2026 CWE-79
Priority LOW 23
The platform allows persistent HTML injection into editable fields managed by TinyMCE.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00234 · Published 2026-11-04 · Fixed in 04/11/2026 CWE-80
Open these records in search → All records by CVSS severity
0 2 2 0 0
