VMware

Records1182All Threatist records

Exploited (KEV)41In CISA KEV

CVSS critical188CVSS 9.0–10.0

CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV

TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability HIGH 71KEV 2026-10-28 TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL 100KEV 2026-08-18 TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery CRITICAL 92KEV 2026-03-09 TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability CRITICAL 94KEV 2026-03-03 TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability CRITICAL 100KEV 2026-01-23 TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

12 records in Spring Data Rest · all components

TI-2018-01178 CVE-2018-1273 · GHSA-4fq3-mr56-cg6r

Code injection in Spring Framework

CRITICAL 100KEV

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96956 Published 2018-04-11 Partial fix · 1.13.11, 2.0.6 CWE-94

TI-2017-05637 CVE-2017-8046 · GHSA-9qf9-28h9-hqcj

Improper input validation in Pivotal Spring Data REST and Spring Boot

HIGH 81

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.7453 Published 2018-01-04 Fixed in 2.6.9.RELEASE, 3.0.1.RELEASE CWE-20

TI-2018-01164 CVE-2018-1259 · GHSA-m929-7fr6-cvjg

XML external entity injection in Pivotal Spring Data Commons

MEDIUM 41

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML exte…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04843 Published 2018-05-11 Fixed in 1.13.12, 2.0.7 CWE-611

TI-2026-30242 CVE-2026-41728 · GHSA-cv39-x4c6-hhp2

Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

LOW 39

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-284

TI-2026-30243 CVE-2026-41729 · GHSA-j388-8rm5-p97f

Spring Data REST SpEL Injection via Map Key in JSON Patch

LOW 37

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00408 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +3 CWE-917

TI-2018-01179 CVE-2018-1274 · GHSA-5q8m-mqmx-pxp9

Resource allocation without limits in Spring Framework

LOW 37

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01941 Published 2018-04-18 Partial fix · 1.13.11, 2.0.6 CWE-770

TI-2026-35301 CVE-2026-47849 · GHSA-4xj4-jmcc-9rq7

Spring Data REST allows mutation of identifier and version properties via JSON Patch

LOW 31

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-08-27 No fix listed CWE-915

TI-2026-30247 CVE-2026-41837 · GHSA-mwpv-rg79-863c

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

LOW 29

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00191 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-284

TI-2026-30244 CVE-2026-41730 · GHSA-p5mm-xwgq-whfr

Spring Data REST exposes persistence-layer internals in error responses

LOW 29

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00197 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-209

TI-2021-05087 CVE-2021-22047 · GHSA-4926-qpxg-6r3w

Information disclosure in Spring Data REST

LOW 25

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping ar…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00771 Published 2021-10-28 Fixed in 3.4.14, 3.5.6 CWE-200

TI-2026-35302 CVE-2026-47850 · GHSA-qmj8-w7c8-vhgx

Spring Data REST allows mutation of the version property of immutable aggregates via PUT

LOW 20

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00306 Published 2026-08-26 No fix listed CWE-915

TI-2022-13598 CVE-2022-31679 · GHSA-fv7x-v67w-cvqv

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in…

LOW 18

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying doma…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00562 Published 2022-09-21 Fixed in 3.6.7, 3.7.3

Open these records in search →

Critical	188
High	460
Medium	480
Low	54
No CVSS	0