VMware

Records1182All Threatist records

Exploited (KEV)41In CISA KEV

CVSS critical188CVSS 9.0–10.0

CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV

TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability HIGH 71KEV 2026-10-28 TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL 100KEV 2026-08-18 TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery CRITICAL 92KEV 2026-03-09 TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability CRITICAL 94KEV 2026-03-03 TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability CRITICAL 100KEV 2026-01-23 TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

11 records in Spring Cloud Function · all components

TI-2022-07140 CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

CRITICAL 100KEV

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99938 Published 2022-04-01 Fixed in 3.2.3, 3.1.7 CWE-94

TI-2022-07155 CVE-2022-22979 · GHSA-q588-3544-8g33

Resource allocation without limits in Spring Cloud Function

LOW 36

In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Funct…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01407 Published 2022-06-21 Fixed in 3.2.6 CWE-770

TI-2026-29641 CVE-2026-40990 · GHSA-x4h3-g2x4-8gqv

Unbounded cache for function definitions

LOW 28

OOM error is possible while attempting to add infinite amount of functions to Function Registry.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 Fixed in 3.2.16, 4.1.10 +3 CWE-770

TI-2026-29640 CVE-2026-40989 · GHSA-x9c7-5h6g-hq8q

Self Routing guard bypassed via function composition

LOW 28

Under infinite recursion in the routing layer, request-handling can cause OOM error.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 Partial fix · 3.2.16, 4.1.10 +3 CWE-674

TI-2026-42423 CVE-2026-59291 · GHSA-6mg8-cpx2-hrff

Server-side request forgery in VMware Spring Cloud Function

LOW 24

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00245 Published 2026-08-27 No fix listed CWE-918

TI-2026-42434 CVE-2026-59302 · GHSA-xrpv-44g5-7jxr

Sensitive information in log files in VMware Spring Cloud Stream

LOW 22

Potential for logging sensitive data in Spring Cloud Stream.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00232 Published 2026-08-27 No fix listed CWE-532

TI-2026-42433 CVE-2026-59301 · GHSA-mrhq-pfwx-89gm

Sensitive information in log files in VMware Spring Cloud Function

LOW 22

Potential for logging sensitive data in Spring Cloud Function Azure.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00232 Published 2026-08-27 No fix listed CWE-532

TI-2026-42432 CVE-2026-59300 · GHSA-qf3f-pjrj-5m4x

Sensitive information in log files in VMware Spring Cloud Function

LOW 16

Potential for logging sensitive data in Spring Cloud Function AWS.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00211 Published 2026-08-27 No fix listed CWE-532

TI-2026-42431 CVE-2026-59299 · GHSA-r954-5cwm-rfh6

Composition lookup can potentially poison base function in Spring Cloud Function

LOW 16

Composition lookup can potentially poison base function in Spring Cloud Function.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00211 Published 2026-08-27 No fix listed CWE-471

TI-2026-42430 CVE-2026-59298 · GHSA-mwgg-hfwg-mqmx

Improper input validation in VMware Spring Cloud Function

LOW 16

Potential for improper filtering of HTTP headers in Spring Cloud Function.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00225 Published 2026-08-27 No fix listed CWE-20

TI-2026-42429 CVE-2026-59297 · GHSA-x389-8jh6-xrxm

Spring Cloud Function can incorrectly determine if URI is secure

LOW 16

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00134 Published 2026-08-27 No fix listed CWE-346

Open these records in search →