Skip to contentVmware vulnerabilities
Products
Show 120 moreShow less
Newest
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in UrlHandlerFilterCVE-2026-47883Public exploit6.1 Medium
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesCVE-2026-592786.5 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreRemote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)CVE-2026-592756.6 Medium
- spring integration, vmware spring integration +1 moreUnbounded decompression in UnZipTransformer enables zip-bomb DoSCVE-2026-592746.5 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreAdmin password disclosed in BrokerNotAliveException messageCVE-2026-592715.3 Medium
- spring security, vmware spring security +1 moreSpring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesCVE-2026-59270Fix available9.4 Critical
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Native Environment Repository ExposureCVE-2026-478944.9 Medium
- spring integration, vmware spring integration +1 moreDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesCVE-2026-478805.4 Medium
- spring cloud gateway, vmware spring cloud gateway +1 moreSpring Cloud Gateway SSRF and native file access with gRPCCVE-2026-478797.7 High
- spring security, vmware spring security +1 moreSpring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)CVE-2026-478778.2 High
- spring integration, vmware spring integration +1 moreUnsafe Java deserialization in SerializingHttpMessageConverter — remote code executionCVE-2026-478646.4 Medium
- spring data rest, vmware spring data rest +1 moreSpring Data REST allows mutation of identifier and version properties via JSON PatchCVE-2026-47849Fix available7.1 High
- spring framework, vmware spring framework +1 moreSpring Framework Server Sent Event stream corruption while rendering fragmentsCVE-2026-47890Fix available9.8 Critical
- pivotal reactor nettyReactor Netty HTTP Server Denial of Service With Pipelined RequestsCVE-2026-478745.3 Medium
- spring integration, vmware spring integration +1 moreUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseCVE-2026-47861Fix available6.3 Medium
- spring integration, vmware spring integration +1 moreZipTransformer uses file_name header to build workDirectory path without sanitizationCVE-2026-478625.4 Medium
- spring amqp, vmware spring advanced message queuing protocol +1 moreUnbounded decompression of attacker-supplied compressed message bodiesCVE-2026-478606.5 Medium
- spring integration, vmware spring integration +1 moreUnbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoSCVE-2026-478595.4 Medium
- spring integration, vmware spring integration +1 moreJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listCVE-2026-47856Fix available6.3 Medium
- spring ai, vmware spring ai +1 morePredictable cache directory location allows local ONNX model substitution in Spring AICVE-2026-478527.5 High
- spring ai, vmware spring ai +1 moreUnbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderCVE-2026-478517.5 High
- spring data rest, vmware spring data rest +1 moreSpring Data REST allows mutation of the version property of immutable aggregates via PUTCVE-2026-47850Fix available4.3 Medium
- broadcom reactor nettyReactor Netty HTTP Server may incorrectly evaluate proxy addressesCVE-2026-478455.3 Medium
- broadcom reactor nettyReactor Netty WebSocket Client Leaks Credentials On RedirectCVE-2026-478486.1 Medium
- broadcom reactor nettyReactor Netty HTTP Server Leaks Exception DetailsCVE-2026-478445.3 Medium
- broadcom reactor nettyReactor Netty may incorrectly route traffic due to DNS resolver reuseCVE-2026-478433.7 Low
- spring security, vmware spring security +1 moreDeterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext CorrelationCVE-2026-478426.5 Medium
- spring data jpa, vmware spring data jpa +1 moreSpring Data JPA Sort expression validation bypassCVE-2026-47834Fix available4.8 Medium
- spring security, vmware spring security +1 moreWebAuthn User Verification Bypass via Session SerializationCVE-2026-478417.4 High
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsCVE-2026-478376.8 Medium
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Susceptible To TOCTOU Attack When Using SVNCVE-2026-478367.2 High
- spring security, vmware spring security +1 moreSpring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof ReplayCVE-2026-417077.4 High
- spring ai, vmware spring ai +1 moreDefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt InjectionCVE-2026-593186.5 Medium
- spring ai, vmware spring ai +1 moreSemantic Cache Cross-Tenant Isolation Bypass via SHA-256 TruncationCVE-2026-593084.2 Medium
- spring ai, vmware spring ai +1 moreUnbounded persistent session allocation via repeated initialize requestsCVE-2026-592797.5 High
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL Denial of Service via pagination supportCVE-2026-592897.5 High
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL Information Exposure in GraphiQL supportCVE-2026-592887.4 High
- spring for graphql, vmware spring for graphql +1 moreSpring for GraphQL loads Untrusted Resources in GraphiQL supportCVE-2026-592868.1 High
- spring framework, vmware spring framework +1 moreSpring Framework Cross-site Scripting via EscapedErrorsCVE-2026-592816.1 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Path Traversal via Backslash in SpringTemplateLoaderCVE-2026-592804.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketServiceCVE-2026-478937.5 High
- spring framework, vmware spring framework +1 moreSpring Framework Header Predicate Bypass in WebFlux Functional EndpointsCVE-2026-47892Fix available9.8 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in UrlFileNameViewControllerCVE-2026-47887Fix available6.1 Medium
- broadcom vmware esx, vmware esx, cloud foundation +3 more +5 moreESX insufficient logging vulnerabilityCVE-2026-41709In KEV2.7 Low
- vmware esx, fusion, workstation +3 more +5 moreOut-of-bounds read vulnerabilityCVE-2026-417037.6 High
- vmware esx, cloud foundation, telco cloud platform +1 more +3 moreVMXNET3 out-of-bounds write vulnerabilityCVE-2026-478769.3 Critical
- vmware vcenter, cloud foundation, telco cloud infrastructure +3 more +5 morevCenter authentication-bypass vulnerabilityCVE-2026-593099.8 Critical
- broadcom vmware vcenter, vmware vcenter, cloud foundation +4 more +6 morevCenter directory-traversal vulnerabilityCVE-2026-59310In KEVPublic exploitEPSS 61.7%9.8 Critical
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Directory Traversal VulnerabilityCVE-2026-478718.8 High
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Privilege Escalation VulnerabilityCVE-2026-478707.1 High
- Show moreLoading…