VMware

Records1182All Threatist records

Exploited (KEV)41In CISA KEV

CVSS critical188CVSS 9.0–10.0

CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV

TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability HIGH 71KEV 2026-10-28 TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL 100KEV 2026-08-18 TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery CRITICAL 92KEV 2026-03-09 TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability CRITICAL 94KEV 2026-03-03 TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability CRITICAL 100KEV 2026-01-23 TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

16 records in Aria Operations · all components

TI-2026-18246 CVE-2026-22719 · GHSA-2hp7-6cr6-jvxh

VMware Aria Operations command injection vulnerability

CRITICAL 94KEV

VMware Aria Operations contains a command injection vulnerability.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.18321 Published 2026-02-25 Fixed in 8.18.6, 9.0.2 +1 CWE-77

TI-2025-27491 CVE-2025-41244 · GHSA-76fp-m4vp-hxrq

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple…

CRITICAL 93KEV

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.15841 Published 2025-09-29 Fixed in 9.0.1.0, 13.0.5.0 +2 CWE-267

TI-2026-18247 CVE-2026-22720 · GHSA-rr3q-q2xp-f894

VMware Aria Operations stored cross-site scripting vulnerability

MEDIUM 41

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00447 Published 2026-02-25 Fixed in 8.18.6, 5.2.3 +2 CWE-79

TI-2026-30239 CVE-2026-41724 · GHSA-76rr-q8xf-r868

Cross-site scripting in VMware VCF operations

LOW 37

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform admini…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00313 Published 2026-06-08 No fix listed CWE-79

TI-2026-30238 CVE-2026-41723 · GHSA-wfp8-3hcq-xm45

Cross-site scripting in VMware VCF operations

LOW 37

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00399 Published 2026-06-08 No fix listed CWE-79

TI-2026-30237 CVE-2026-41722 · GHSA-3q9r-4xf6-m724

Cross-site scripting in VMware VCF operations

LOW 37

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00302 Published 2026-06-08 No fix listed CWE-79

TI-2024-26058 CVE-2024-38831 · GHSA-7mjq-fcrm-26pg

Local privilege escalation vulnerability (CVE-2024-38831)

LOW 36

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00293 Published 2024-11-26 Fixed in 8.18.2 CWE-77

TI-2026-18248 CVE-2026-22721 · GHSA-p743-h3f6-5f74

VMware Aria Operations privilege escalation vulnerability

LOW 35

VMware Aria Operations contains a privilege escalation vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00739 Published 2026-02-25 Fixed in 8.18.6, 5.2.3 +1 CWE-269

TI-2024-26057 CVE-2024-38830 · GHSA-88h9-qf46-pmjc

Local privilege escalation in VMware Aria Operations

LOW 35

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00178 Published 2024-11-26 Fixed in 8.18.2 CWE-269

TI-2025-16133 CVE-2025-22222 · GHSA-9h7m-pf82-g666

VMware Aria Operations information disclosure vulnerability (CVE-2025-22222)

LOW 34

VMware Aria Operations contains an information disclosure vulnerability.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00548 Published 2025-01-30 Fixed in 8.18.3 CWE-497

TI-2024-26059 CVE-2024-38832 · GHSA-6vqg-wm4f-f8vx

Stored cross-site scripting vulnerability (CVE-2024-38832)

LOW 32

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0044 Published 2024-11-26 Fixed in 8.18.2 CWE-79

TI-2024-14825 CVE-2024-22235 · GHSA-36mr-3fcp-m422

Improper privilege management in VMware Aria Operations

LOW 31

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00194 Published 2024-02-21 No fix listed CWE-269

TI-2023-16909 CVE-2023-34043 · GHSA-535x-q4gm-f2m7

Improper privilege management in VMware Aria Operations

LOW 31

VMware Aria Operations contains a local privilege escalation vulnerability.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00186 Published 2023-09-26 No fix listed CWE-269

TI-2023-07296 CVE-2023-20880 · GHSA-3grg-4gwx-fp3c

Incorrect authorization in VMware Aria Operations

LOW 31

VMware Aria Operations contains a privilege escalation vulnerability.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00224 Published 2023-05-12 No fix listed CWE-863

TI-2024-26060 CVE-2024-38833 · GHSA-mff4-qp47-8h8q

Stored cross-site scripting vulnerability (CVE-2024-38833)

LOW 30

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00423 Published 2024-11-26 Fixed in 8.18.2 CWE-79

TI-2024-26061 CVE-2024-38834 · GHSA-m2m4-2g99-6625

Stored cross-site scripting vulnerability (CVE-2024-38834)

LOW 29

VMware Aria Operations contains a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00332 Published 2024-11-26 Fixed in 8.18.2 CWE-79

Open these records in search →