VMware
1172 CVEs across 295 VMware products. Browse VMware vulnerabilities, severities, and proof-of-concept exploits.
VMware products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59324 | High | 8.2 | 2026-08-27 | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessage… |
CVE-2026-59322 | Medium | 6.3 | 2026-08-27 | The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte pay… |
CVE-2026-59321 | Medium | 4.2 | 2026-08-27 | A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th… |
CVE-2026-59320 | Medium | 6.5 | 2026-08-27 | When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin… |
CVE-2026-59319 | Medium | 4.3 | 2026-08-27 | RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()… |
CVE-2026-59317 | Medium | 6.5 | 2026-08-27 | DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi… |
CVE-2026-59315 | Medium | 5.3 | 2026-08-27 | The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0… |
CVE-2026-59314 | Low | 3.7 | 2026-08-27 | Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file… |
CVE-2026-59313 | Critical | 9.8 | 2026-08-27 | Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7… |
CVE-2026-59311 | Medium | 6.8 | 2026-08-27 | A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer… |
CVE-2026-59307 | High | 8.0 | 2026-08-27 | An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bea… |
CVE-2026-59306 | Low | 3.1 | 2026-08-27 | Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Strea… |
CVE-2026-59305 | Low | 3.1 | 2026-08-27 | Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4… |
CVE-2026-59304 | Low | 3.1 | 2026-08-27 | Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Str… |
CVE-2026-59303 | Low | 3.1 | 2026-08-27 | Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud S… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functio… |
CVE-2026-59299 | Low | 3.1 | 2026-08-27 | Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Sprin… |
CVE-2026-59298 | Low | 3.1 | 2026-08-27 | Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud… |
CVE-2026-59297 | Low | 3.1 | 2026-08-27 | Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |
CVE-2026-59293 | Medium | 6.6 | 2026-08-27 | Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vuln… |
CVE-2026-59292 | Low | 3.2 | 2026-08-27 | PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.pr… |
CVE-2026-59291 | Low | 2.0 | 2026-08-27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring C… |
CVE-2026-59289 | High | 7.5 | 2026-08-27 | Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying reposito… |
CVE-2026-59288 | High | 7.4 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the… |
CVE-2026-59287 | Medium | 5.9 | 2026-08-27 | Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring f… |
CVE-2026-59286 | High | 8.1 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject ma… |
CVE-2026-59285 | High | 8.1 | 2026-08-27 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 |
CVE-2026-59283 | Critical | 9.1 | 2026-08-27 | Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL… |
CVE-2026-59282 | High | 7.5 | 2026-08-27 | Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a D… |
CVE-2026-59281 | Medium | 6.1 | 2026-08-27 | Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Er… |
CVE-2026-59277 | Low | 3.7 | 2026-08-27 | Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a gi… |
CVE-2026-59276 | Medium | 5.9 | 2026-08-27 | Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison… |
CVE-2026-59280 | Medium | 4.3 | 2026-08-27 | Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from un… |
CVE-2026-59272 | Medium | 6.8 | 2026-08-27 | Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of… |
CVE-2026-59355 | Medium | 6.1 | 2026-08-27 | In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An at… |
CVE-2026-59354 | Critical | 9.6 | 2026-08-27 | In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registrati… |
CVE-2026-59278 | Medium | 6.5 | 2026-08-27 | JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default… |
CVE-2026-59275 | Medium | 6.6 | 2026-08-27 | A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload… |
CVE-2026-59274 | Medium | 6.5 | 2026-08-27 | The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can… |
CVE-2026-59271 | Medium | 5.3 | 2026-08-27 | When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 S… |
CVE-2026-59270 | Critical | 9.4 | 2026-08-27 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avai… |
CVE-2026-47894 | Medium | 4.9 | 2026-08-27 | Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config… |
CVE-2026-47893 | High | 7.5 | 2026-08-27 | A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception… |
CVE-2026-47892 | Critical | 9.8 | 2026-08-27 | A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Sp… |
CVE-2026-47891 | Critical | 9.8 | 2026-08-27 | A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7… |
CVE-2026-47890 | Critical | 9.8 | 2026-08-27 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8… |
CVE-2026-47889 | High | 7.5 | 2026-08-27 | A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 … |
CVE-2026-47888 | High | 7.5 | 2026-08-27 | A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Fra… |
CVE-2026-47887 | Medium | 6.1 | 2026-08-27 | A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open… |
CVE-2026-47886 | High | 7.5 | 2026-08-27 | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power ope… |
CVE-2026-47885 | High | 7.5 | 2026-08-27 | The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Sprin… |
CVE-2026-47884 | Critical | 9.8 | 2026-08-27 | Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where… |
CVE-2026-47883 | Medium | 6.1 | 2026-08-27 | UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Sp… |
CVE-2026-47880 | Medium | 5.4 | 2026-08-27 | A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, erro… |
CVE-2026-47879 | High | 7.7 | 2026-08-27 | Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 -… |
CVE-2026-47877 | High | 8.2 | 2026-08-27 | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security… |
CVE-2026-47864 | Medium | 6.4 | 2026-08-27 | SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with C… |
CVE-2026-47849 | High | 7.1 | 2026-08-27 | Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) reque… |
CVE-2026-47862 | Medium | 5.4 | 2026-08-27 | An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive… |
CVE-2026-47861 | Medium | 6.3 | 2026-08-27 | An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP da… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2026-47859 | Medium | 5.4 | 2026-08-27 | RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet cou… |
CVE-2026-47856 | Medium | 6.3 | 2026-08-27 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a cl… |
CVE-2026-47852 | High | 7.5 | 2026-08-27 | A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47850 | Medium | 4.3 | 2026-08-27 | Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. S… |
CVE-2026-47842 | Medium | 6.5 | 2026-08-26 | Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES… |
CVE-2026-47834 | Medium | 4.8 | 2026-08-26 | Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring… |
CVE-2026-47841 | High | 7.4 | 2026-08-26 | An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Secur… |
CVE-2026-47837 | Medium | 6.8 | 2026-08-26 | Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpo… |
CVE-2026-47836 | High | 7.2 | 2026-08-26 | The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check… |
CVE-2026-41707 | High | 7.4 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based repl… |
CVE-2026-59318 | Medium | 6.5 | 2026-08-21 | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatche… |
CVE-2026-59308 | Medium | 4.2 | 2026-08-21 | In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be sh… |
CVE-2026-59279 | High | 7.5 | 2026-08-21 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not r… |
CVE-2026-59296 | Medium | 5.9 | 2026-08-21 | Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose in… |
CVE-2026-59323 | Medium | 5.3 | 2026-08-21 | An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object alloc… |
CVE-2026-41709 | Low | 2.7 | 2026-07-30 | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being… |
CVE-2026-59310 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to ex… |
CVE-2026-59309 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit th… |
CVE-2026-47876 | Critical | 9.3 | 2026-07-30 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a vi… |
CVE-2026-41703 | High | 7.6 | 2026-07-30 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds… |
CVE-2026-47871 | High | 8.8 | 2026-07-18 | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform di… |
CVE-2026-47870 | High | 7.1 | 2026-07-18 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. … |
CVE-2026-47869 | High | 8.7 | 2026-07-18 | VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute c… |
CVE-2026-47868 | High | 7.8 | 2026-07-18 | VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to ru… |
CVE-2026-47867 | High | 8.7 | 2026-07-18 | VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and e… |
CVE-2026-47866 | High | 8.3 | 2026-07-18 | VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane… |
CVE-2026-47865 | Critical | 9.8 | 2026-07-18 | VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by b… |
CVE-2026-59269 | Low | 3.8 | 2026-07-09 | A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following… |
CVE-2026-47835 | High | 8.6 | 2026-06-15 | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Af… |
CVE-2026-41856 | High | 7.5 | 2026-06-11 | The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This… |
CVE-2026-41700 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authentica… |
CVE-2026-41699 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL r… |
CVE-2026-41001 | Medium | 5.3 | 2026-06-11 | Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is c… |
CVE-2026-40992 | Medium | 5.0 | 2026-06-11 | Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properti… |
CVE-2026-40987 | High | 7.1 | 2026-06-11 | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attack… |