Cloud Foundation at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 5 | 3 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 5 | 3 |
| Jun 2025 | 0 | 0 |
| May 2025 | 6 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
Critical max 9.2
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
first Oct 21, 2026 -
High max 7.8
VMware Cloud Foundation, vSphere, Aria Operations und Tools: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in VMware Cloud Foundation, VMware vSphere, VMware Aria Operations und VMware Tools ausnutzen, um erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen und vertrauliche Informationen offenzulegen.
first Sep 29, 2025 -
Critical max 10.0
Apache log4j: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen.
first Dec 9, 2021 -
High max 8.0
VMware Cloud Foundation Operations: Mehrere Schwachstellen ermöglichen Cross-Site Scripting
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware Cloud Foundation, VMware Aria Operations und VMware vSphere ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, wodurch er möglicherweise administrative Aktionen ausfü…
first Jun 7, 2026 -
High max 9.3
VMware Produkte: Mehrere Schwachstellen
Ein lokaler Angreifer kann mehrere Schwachstellen in VMware vSphere, VMware Tools, VMware ESXi, VMware Workstation, VMware Fusion und VMware Cloud Foundation ausnutzen, um beliebigen Programmcode auszuführen und vertrauliche Informationen preiszugeben.
first Jul 15, 2025
17 results · Feed
-
Low 2.7CVE-2026-41709 Exploited
ESX insufficient logging vulnerability
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
KEV Oct 28, 2026 -
High 7.6
Out-of-bounds read vulnerability
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condit…
-
Critical 9.3
VMXNET3 out-of-bounds write vulnerability
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the hos…
-
Critical 9.8
vCenter authentication-bypass vulnerability
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
-
Critical 9.8
vCenter directory-traversal vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
KEV Aug 18, 2026 -
High 8.5
Header injection vulnerability
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
-
Medium 4.4
Denial-of-service vulnerability
VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition.
-
High 7.1
vSockets information-disclosure vulnerability
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit thi…
-
Critical 9.3
PVSCSI heap-overflow vulnerability
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue…
-
Critical 9.3
VMCI integer-underflow vulnerability
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to exe…
-
Critical 9.3
VMXNET3 integer-overflow vulnerability
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to e…
-
Medium 4.3CVE-2025-41228 Public exploit
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal co…
-
Medium 5.5
Denial-of-Service Vulnerability
VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the hos…
-
Medium 6.8
Guest Operations Denial-of-Service Vulnerability
VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a den…
-
High 8.8
VMware vCenter Server authenticated command-execution vulnerability
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
-
High 7.5
VMware Cloud Foundation Information Disclosure Vulnerability
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
-
High 8.2
VMware Cloud Foundation Directory Traversal Vulnerability
VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.