VMware vulnerabilities
241 CVEs and advisories name VMware as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-22717VMware Workstation out-of-bound read vulnerability
- CVE-2026-22716VMware Workstation out-of-bounds write vulnerability
- CVE-2026-22722VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash
- CVE-2026-22715VMware Workstation/Fusion NAT vulnerability
- CVE-2026-22721VMware Aria Operations privilege escalation vulnerability
- CVE-2026-22720VMware Aria Operations stored cross-site scripting vulnerability
- CVE-2026-22719VMware Aria Operations command injection vulnerability
- CVE-2026-2818Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)
- CVE-2026-2817Spring Data Geode Insecure Temporary Directory Usage
- CVE-2025-41254Spring Framework STOMP CSRF Vulnerability
- CVE-2025-41253Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables
- CVE-2025-41252Username enumeration vulnerability
- CVE-2025-41251Weak password recovery vulnerability
- CVE-2025-41250Header injection vulnerability
- CVE-2025-41245VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- CVE-2025-41244VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- CVE-2025-41246Improper authorisation vulnerability
- CVE-2025-41249CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
- CVE-2025-41248CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types
- CVE-2025-41242CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
- CVE-2025-41241Denial-of-service vulnerability
- CVE-2025-41240Mounted Kubernetes Secrets under a predictable path located within the web server document root
- CVE-2025-22227CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client
- CVE-2025-41239vSockets information-disclosure vulnerability
- CVE-2025-41238PVSCSI heap-overflow vulnerability
- CVE-2025-41237VMCI integer-underflow vulnerability
- CVE-2025-41236VMXNET3 integer-overflow vulnerability
- CVE-2024-38824CVE-2024-38824 salt advisory
- CVE-2025-22242CVE-2025-22242 salt advisory
- CVE-2025-22241CVE-2025-22241 salt advisory