Coupa has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 6.2 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Weakness classes
Products
- Coupa Total Spend Management Platform 4
Worst active — by depth score
CVE-2026-111036High· 8.4Multiple vulnerabilities in Coupa’s Total Spend Management Platform46CVE-2026-111038High· 7.3Multiple vulnerabilities in Coupa’s Total Spend Management Platform40CVE-2026-111040Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform28CVE-2026-111037Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform28
Coupa vulnerabilities
CVEs affecting Coupa, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-111040Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other u…
CVE-2026-111038High· 7.3Multiple vulnerabilities in Coupa’s Total Spend Management Platform
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are no…
CVE-2026-111036High· 8.4Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient…
CVE-2026-111037Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without prop…