VMware vulnerabilities
241 CVEs and advisories name VMware as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-59347VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability
- CVE-2026-59346VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability
- CVE-2026-59355Spring Authorization Server: Open Redirect via request_uri parameter
- CVE-2026-41709ESX insufficient logging vulnerability
- CVE-2026-41703Out-of-bounds read vulnerability
- CVE-2026-47876VMXNET3 out-of-bounds write vulnerability
- CVE-2026-59309vCenter authentication-bypass vulnerability
- CVE-2026-59310vCenter directory-traversal vulnerability
- CVE-2026-47871VMware Avi Load Balancer Directory Traversal Vulnerability
- CVE-2026-47870VMware Avi Load Balancer Privilege Escalation Vulnerability
- CVE-2026-47869VMware Avi Load Balancer Remote Code Execution Vulnerability
- CVE-2026-47868VMware Avi Load Balancer Local Privilege Escalation Vulnerability
- CVE-2026-47867VMware Avi Load Balancer Remote Code Execution Vulnerability
- CVE-2026-47866VMware Avi Load Balancer Authorization Bypass Vulnerability
- CVE-2026-47865VMware Avi Load Balancer Authentication Bypass Vulnerability
- CVE-2026-59269Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries
- CVE-2026-41724VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
- CVE-2026-41723VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
- CVE-2026-41722VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
- CVE-2026-41702TOCTOU local privilege escalation vulnerability
- CVE-2026-41713Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
- CVE-2026-41712ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
- CVE-2026-22745CVE-2026-22745 : Denial of service in static resource handling on Windows platforms
- CVE-2026-22741Static resource cache poisoning in Spring MVC and WebFlux
- CVE-2026-22740Spring Framework DoS with Multipart Temp Files in WebFlux
- CVE-2026-40966VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
- CVE-2026-22750SSL bundle configuration silently bypassed in Spring Cloud Gateway
- CVE-2026-22732Under Some Conditions Spring Security HTTP Headers Are not Written
- CVE-2026-22729CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
- CVE-2026-22730CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter