Vulnerabilities

TI-2026-85010 CVE-2026-111040 · GHSA-x5j7-r8g5-qxr3

Stored HTML injection in Coupa Total Spend Management Platform

LOW 23

The platform allows persistent HTML injection into editable fields managed by TinyMCE.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00234 Published 2026-11-04 Fixed in 04/11/2026 CWE-80

TI-2026-85006 CVE-2026-111038 · GHSA-6jm3-qvcw-858v

LOW 32

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00347 Published 2026-11-04 Fixed in 04/11/2026 CWE-1236

TI-2026-85005 CVE-2026-111037 · GHSA-jfgq-g3fh-wr9x

LOW 24

A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00463 Published 2026-11-04 Fixed in 04/11/2026 CWE-79