Coupa
Vulnerability activity for Coupa: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.1MediumNov 4, 2026Coupa Total Spend Management Platform XSSCVE-2026-111040The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
- 7.3HighNov 4, 2026Coupa Total Spend Management PlatformCVE-2026-111038CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim dow
- 5.1MediumNov 4, 2026Coupa Total Spend Management Platform XSSCVE-2026-111037A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbi
- 8.4HighNov 4, 2026Coupa Total Spend Management Platform SSRFCVE-2026-111036Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to ex
Top products
- Coupa Total Spend Management Platform4 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- ENISA EUVD · Nov 4, 2026EUVD-2026-116823 · The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated…CVE-2026-111040
- ENISA EUVD · Nov 4, 2026EUVD-2026-116822 · CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS…CVE-2026-111038
- ENISA EUVD · Nov 4, 2026EUVD-2026-116821 · A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal…CVE-2026-111037
- ENISA EUVD · Nov 4, 2026EUVD-2026-116820 · Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically…CVE-2026-111036
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.