VMware vulnerabilities
241 CVEs and advisories name VMware as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-22240CVE-2025-22240 salt advisory
- CVE-2025-22239CVE-2025-22239 salt advisory
- CVE-2025-22238CVE-2025-22238 salt advisory
- CVE-2025-22237CVE-2025-22237 salt advisory
- CVE-2025-22236CVE-2025-22236 salt advisory
- CVE-2024-38825CVE-2024-38825 Salt Advisory
- CVE-2024-38823CVE-2024-38823 Salt Advisory
- CVE-2024-38822CVE-2024-38822 Salt Advisory
- CVE-2025-41233Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability.
- CVE-2025-41234RFD Attack via “Content-Disposition” Header Sourced from Request
- CVE-2025-22245VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.
- CVE-2025-22244VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
- CVE-2025-22243VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.
- CVE-2025-41235CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
- CVE-2025-41228VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
- CVE-2025-41227Denial-of-Service Vulnerability
- CVE-2025-41226Guest Operations Denial-of-Service Vulnerability
- CVE-2025-41225VMware vCenter Server authenticated command-execution vulnerability
- CVE-2025-41230VMware Cloud Foundation Information Disclosure Vulnerability
- CVE-2025-41229VMware Cloud Foundation Directory Traversal Vulnerability
- CVE-2025-22248[pgpool] Unauthenticated access to postgres through pgpool
- CVE-2025-22249VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)
- CVE-2025-22231VMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231)
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.
- CVE-2025-22222VMware Aria Operations information disclosure vulnerability (CVE-2025-22222)
- CVE-2025-22221VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22221)
- CVE-2025-22220VMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)
- CVE-2025-22219VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219)
- CVE-2025-22218VMware Aria Operations for Logs information disclosure vulnerability
- CVE-2025-22215VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)