Read the docs

VMware

Records1182All Threatist records
Exploited (KEV)41In CISA KEV
CVSS critical188CVSS 9.0–10.0
CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV
TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability Priority HIGH 71KEV 2026-10-28TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-08-18TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery Priority CRITICAL 92KEV 2026-03-09TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability Priority CRITICAL 94KEV 2026-03-03TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Priority CRITICAL 100KEV 2026-01-23TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability Priority CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records
Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

9 records in Spring For Graphql · all components

TI-2026-30215 CVE-2026-41699 · GHSA-px92-q6rc-6mwv

Unsafe Deserialization in Spring GraphQL

Priority MEDIUM 43

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00431 Published 2026-06-11 Fixed in 2.0.3.1, 1.4.5.1 +3 CWE-502
TI-2026-42422 CVE-2026-59289 · GHSA-ffhp-m2c7-jv8h

Spring for GraphQL Denial of Service via pagination support

Priority LOW 39

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-08-27 No fix listed CWE-770
TI-2026-30266 CVE-2026-41856 · GHSA-phxq-526m-79px

Spring GraphQL Annotation Detection Vulnerability

Priority LOW 39

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-06-11 Fixed in 2.0.3.1, 1.4.5.1 +4 CWE-284
TI-2026-30216 CVE-2026-41700 · GHSA-m39w-hqxx-3r48

Cross-Site WebSocket Hijacking in Spring for GraphQL

Priority LOW 36

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00189 Published 2026-06-11 Fixed in 2.0.3.1, 1.4.5.1 +4 CWE-346
TI-2026-42420 CVE-2026-59287 · GHSA-ch79-c8j8-qqf6

Spring for GraphQL WebSocket Client Denial of Service

Priority LOW 27

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00367 Published 2026-08-27 No fix listed CWE-770
TI-2023-16913 CVE-2023-34047 · GHSA-frqc-f2h8-fjvf

Exposure of data and identity to wrong session in Spring for GraphQL

Priority LOW 20

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00418 Published 2023-09-20 Fixed in 1.1.6, 1.2.3
Open these records in search →