Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

VMware — Vulnerabilities & Security Advisories 241

Browse all 241 CVE security advisories affecting VMware. AI-powered Chinese analysis, POCs, and references for each vulnerability.

VMware operates as a leading provider of cloud computing and virtualization platforms, enabling enterprises to manage data centers and deploy software-defined infrastructure. With 219 recorded CVEs, its attack surface reflects the complexity of managing hypervisors and management interfaces. Historically, vulnerabilities have frequently involved remote code execution, cross-site scripting, and privilege escalation, often stemming from improper input validation or authentication bypasses in web-based management consoles. Notable incidents include critical flaws in vCenter Server and ESXi that allowed attackers to gain unauthorized administrative access or execute arbitrary commands on host systems. These exploits underscore the risks associated with centralized management tools, where a single compromise can impact entire virtualized environments. The high volume of vulnerabilities highlights the necessity for rigorous patch management and secure configuration practices to mitigate potential breaches in enterprise infrastructure.

CVE ID Title CVSS Severity Published
CVE-2026-22717 VMware Workstation out-of-bound read vulnerability — Workstation CWE-125 2.7 Low 2026-02-27
CVE-2026-22716 VMware Workstation out-of-bounds write vulnerability — Workstation CWE-787 5.0 Medium 2026-02-27
CVE-2026-22722 VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash — Workstation CWE-476 6.1 Medium 2026-02-26
CVE-2026-22715 VMware Workstation/Fusion NAT vulnerability — Workstation 5.9 Medium 2026-02-26
CVE-2026-22721 VMware Aria Operations privilege escalation vulnerability — VMware Aria Operations CWE-269 6.2 Medium 2026-02-25
CVE-2026-22720 VMware Aria Operations stored cross-site scripting vulnerability — VMware Aria Operations CWE-79 8.0 High 2026-02-25
CVE-2026-22719 VMware Aria Operations command injection vulnerability — VMware Aria Operations 8.1 High 2026-02-25
CVE-2026-2818 Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific) — Spring Data Geode CWE-23 8.2 High 2026-02-20
CVE-2026-2817 Spring Data Geode Insecure Temporary Directory Usage — Spring Data Geode CWE-538 4.4 Medium 2026-02-19
CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability — Spring Framework CWE-352 4.3 Medium 2025-10-16
CVE-2025-41253 Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables — Spring Cloud Gateway Server Webflux CWE-917 7.5 High 2025-10-16
CVE-2025-41252 Username enumeration vulnerability — NSX CWE-203 7.5 High 2025-09-29
CVE-2025-41251 Weak password recovery vulnerability — NSX CWE-640 8.1 High 2025-09-29
CVE-2025-41250 Header injection vulnerability — vCenter CWE-77 8.5 High 2025-09-29
CVE-2025-41245 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) — VMware Aria Operations CWE-1188 4.9 Medium 2025-09-29
CVE-2025-41244 VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) — VCF operations CWE-267 7.8 High 2025-09-29
CVE-2025-41246 Improper authorisation vulnerability — Tools CWE-863 7.6 High 2025-09-29
CVE-2025-41249 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability — Spring Framework 7.5 High 2025-09-16
CVE-2025-41248 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types — Spring Security 7.5 High 2025-09-16
CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers — Spring Framework 5.9 Medium 2025-08-18
CVE-2025-41241 Denial-of-service vulnerability — vCenter CWE-754 4.4 Medium 2025-07-29
CVE-2025-41240 Mounted Kubernetes Secrets under a predictable path located within the web server document root — bitnamicharts/appsmith 10.0 Critical 2025-07-24
CVE-2025-22227 CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client — Reactor Netty 6.1 Medium 2025-07-16
CVE-2025-41239 vSockets information-disclosure vulnerability — ESXi CWE-908 7.1 High 2025-07-15
CVE-2025-41238 PVSCSI heap-overflow vulnerability — ESXi CWE-787 9.3 Critical 2025-07-15
CVE-2025-41237 VMCI integer-underflow vulnerability — Cloud Foundation CWE-787 9.3 Critical 2025-07-15
CVE-2025-41236 VMXNET3 integer-overflow vulnerability — ESXi CWE-787 9.3 Critical 2025-07-15
CVE-2024-38824 CVE-2024-38824 salt advisory — SALT 9.6 Critical 2025-06-13
CVE-2025-22242 CVE-2025-22242 salt advisory — SALT 5.6 Medium 2025-06-13
CVE-2025-22241 CVE-2025-22241 salt advisory — SALT 5.6 Medium 2025-06-13

This page lists every published CVE security advisory associated with VMware. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.