Skip to content
OpenAdvisories

Vendor

VMware Tanzu

7 known vulnerabilities.

VMware Tanzu at a glance

Last 12 months
0
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

VMware GemFire 2 VMware Tanzu GemFire for VMs 2 Concourse 1 Single Sign-On for VMware Tanzu 1 PCF Autoscaling 1 Operations Manager 1 VMware Tanzu Application Service for VMs 1 RabbitMQ 1 Pivotal Scheduler 1 Spring Cloud 0 Spring Cloud Contract < 4.1.1 0 Spring Cloud Contract < 4.0.5 0 Spring Cloud Contract < 3.1.10 0 Spring Security 0 Spring Framework 0 Spring Framework for Apache Kafka < 2.9.11 0 Spring Framework for Apache Kafka < 3.0.10 0 Spring Framework < 6.0.16 0 Spring Framework < 6.1.3 0 Spring Boot 0

Latest advisories

  • Medium max 7.5
    WID-SEC-2022-0361 2 CVEs rev. 6

    VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of Service

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.

    IBM NETAPP jfrog VMware Tanzu Linux Windows
    first May 10, 2022
  • Medium max 7.5
    WID-SEC-2025-2060 2 CVEs rev. 15

    VMware Tanzu Spring Framework und Spring Security: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security und VMware Tanzu Spring Framework ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

    IBM Red Hat Dell Atlassian Hitachi Linux Windows
    first Sep 15, 2025
  • High max 8.1
    WID-SEC-2026-1828 18 CVEs rev. 6

    VMware Tanzu Spring Framework: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, sensible Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripti…

    IBM Dell VMware Tanzu RealObjects Windows
    first Jun 8, 2026
  • High max 9.8
    WID-SEC-2026-2955 16 CVEs rev. 4

    VMware Tanzu Spring Framework: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, offene Weiterleitungen dur…

    Red Hat VMware Tanzu Windows
    first Aug 20, 2026
  • Medium max 4.8
    WID-SEC-2024-3499 1 CVE rev. 8

    VMware Tanzu Spring Security: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

    IBM Red Hat Dell Hitachi NETAPP Windows
    first Nov 19, 2024
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.6
    CVE-2020-5426

    Scheduler for TAS can transmit privileged UAA token in plaintext

    Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the servi…

    VMware Tanzu Pivotal Scheduler
  • High 7.5
    CVE-2020-5425

    User Impersonation possible in Tanzu SSO

    Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same usern…

    VMware Tanzu Single Sign-On for VMware Tanzu
  • Medium 6.7
    CVE-2020-5419

    RabbitMQ arbitrary code execution using local binary planting

    RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could …

    VMware Tanzu RabbitMQ
  • Critical 10.0
    CVE-2020-5415

    Concourse's GitLab auth allows impersonation

    Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. Gi…

    VMware Tanzu Concourse github.com/concourse/concourse github.com/concourse/dex Go
  • Medium 5.7
    CVE-2020-5414

    App Autoscaler logs credentials

    VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Ma…

    VMware Tanzu Operations Manager PCF Autoscaling VMware Tanzu Application Service for VMs
  • Unscored —
    CVE-2020-5396

    JMX Insecure Default Configuration in GemFire

    VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. …

    VMware Tanzu VMware Tanzu GemFire for VMs VMware GemFire
  • Critical 9.0
    CVE-2019-11286

    JMX Credential Deserialization in GemFire

    VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticate…

    VMware Tanzu VMware Tanzu GemFire for VMs VMware GemFire