Skip to content
OpenAdvisories

Vendor

VMware

241 known vulnerabilities.

Products

Workstation 51 Fusion 42 ESXi 25 Cloud Foundation 17 Telco Cloud Platform 17 VMware Aria Operations 15 VMware ESXi 14 Telco Cloud Infrastructure 14 Workstation Pro/Player 12 SALT 11 Horizon View Client for Windows 9 VMware Telco Cloud Platform 8 Avi Load Balancer 8 Spring Framework 7 VMware Workstation 7 VMware Fusion 7 vSphere Foundation 7 vCenter Server 6 VMware vCenter Server (vCenter Server) 5 VMware Cloud Foundation (vCenter Server) 5 Fusion Pro / Fusion 5 VMware Cloud Foundation 5 Spring AI 5 VMware tools 4 VMware Telco Cloud Infrastructure 4 VMware Aria Operations for Logs 4 VMware vCenter Server 4 vCenter 4 VCF operations 4 Vmware Aria Automation 3 VMware NSX 3 Airwatch Console 3 vRealize Automation 3 Workstation and Fusion 3 vRealize Operations for Horizon Adapter 3 VMware ESXi, Workstation, and Fusion 3 ESX 3 NSX 2 VMware AirWatch Console (AWC) 2 VMware Avi Load Balancer 2
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-41709 Exploited

    ESX insufficient logging vulnerability

    VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

    VMware Telco Cloud Platform Cloud Foundation vSphere Foundation Virtualization
    KEV Oct 28, 2026
  • Low 3.8
    CVE-2026-59269

    Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

    A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProv…

    VMware Pinniped
  • Low 3.1
    CVE-2026-22741

    Static resource cache poisoning in Spring MVC and WebFlux

    Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application …

    VMware Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • Low 2.7
    CVE-2026-22717

    VMware Workstation out-of-bound read vulnerability

    Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed.

    VMware Workstation
  • Low 2.7
    CVE-2024-38823

    CVE-2024-38823 Salt Advisory

    Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.

    VMware SALT salt Ubuntu
  • Low 2.7
    CVE-2024-38822

    CVE-2024-38822 Salt Advisory

    Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.

    VMware SALT salt Ubuntu
  • Low 3.1
    CVE-2024-38820 Public exploit

    CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

    The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

    VMware Spring libspring-java libspring-java Debian Ubuntu Maven
  • Low 3.9
    CVE-2023-20867 Exploited EPSS 14%

    VMware Tools Authentication Bypass Vulnerability

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

    VMware VMware tools open-vm-tools open-vm-tools Debian Ubuntu Alpine
    KEV Jun 23, 2023