VMware security advisories

126 advisories across VMware

Date	Advisory	Severity	Fixed in
Sep 15	VMware sealed-secrets: observable discrepancy Medium4.2Sep 15 CVE-2026-59341No fix yet	Medium4.2	No fix yet
Sep 11	VMware UAA: improper access control Critical9.2Sep 11 CVE-2026-47839No fix yet	Critical9.2	No fix yet
Aug 29	VMware bosh-vsphere-cpi-release: improper certificate validation High7.7Aug 29 CVE-2026-4101298.0.6	High7.7	98.0.6
Aug 27	VMware Spring AMQP: resource leak Medium6.5Aug 27 CVE-2026-59320No fix yet	Medium6.5	No fix yet
Aug 27	VMware Spring Integration: race condition Medium4.2Aug 27 CVE-2026-59321No fix yet	Medium4.2	No fix yet
Aug 27	VMware Spring Integration: improper input validation Medium6.3Aug 27 CVE-2026-59322No fix yet	Medium6.3	No fix yet
Aug 27	VMware Spring Integration: race condition High8.2Aug 27 CVE-2026-59324No fix yet	High8.2	No fix yet
Aug 27	VMware Spring Integration: unsafe deserialization High8.0Aug 27 CVE-2026-59307No fix yet	High8.0	No fix yet
Aug 27	VMware Spring Integration: link following Medium6.8Aug 27 CVE-2026-59311No fix yet	Medium6.8	No fix yet
Aug 27	Spring MVC applications using the functional web framework are vulnerable to... Critical9.8Aug 27 CVE-2026-59313No fix yet	Critical9.8	No fix yet
Aug 27	Applications that build a Content-Disposition header value from untrusted input... Low3.7Aug 27 CVE-2026-59314No fix yet	Low3.7	No fix yet
Aug 27	VMware Spring Cloud Config: denial of service Medium5.3Aug 27 CVE-2026-59315No fix yet	Medium5.3	No fix yet
Aug 27	VMware Spring Authorization Server: cross-site scripting High8.2Aug 27 CVE-2026-59316No fix yet	High8.2	No fix yet
Aug 27	VMware Spring for Apache Kafka: improper quantity validation Medium6.5Aug 27 CVE-2026-59317No fix yet	Medium6.5	No fix yet
Aug 27	VMware Spring AI: attacker could inject RediSearch syntax Medium4.3Aug 27 CVE-2026-59319No fix yet	Medium4.3	No fix yet
Aug 27	VMware Spring Cloud Function: improper input validation Low3.1Aug 27 CVE-2026-59298No fix yet	Low3.1	No fix yet
Aug 27	Composition lookup can potentially poison base function in Spring Cloud Function Low3.1Aug 27 CVE-2026-59299No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Function: secrets in logs Low3.1Aug 27 CVE-2026-59300No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Function: secrets in logs Low3.1Aug 27 CVE-2026-59301No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Stream: secrets in logs Low3.1Aug 27 CVE-2026-59302No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Stream: resource exhaustion Low3.1Aug 27 CVE-2026-59303No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Stream: type confusion Low3.1Aug 27 CVE-2026-59304No fix yet	Low3.1	No fix yet
Aug 27	Partition interceptor may be improperly added while sending message Low3.1Aug 27 CVE-2026-59305No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Cloud Stream: unsafe deserialization Low3.1Aug 27 CVE-2026-59306No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring for GraphQL: information disclosure High7.4Aug 27 CVE-2026-59288No fix yet	High7.4	No fix yet
Aug 27	VMware Spring for GraphQL: denial of service High7.5Aug 27 CVE-2026-59289No fix yet	High7.5	No fix yet
Aug 27	VMware Spring Cloud Function: arbitrary file read Low2.0Aug 27 CVE-2026-59291No fix yet	Low2.0	No fix yet
Aug 27	VMware Spring Integration: insecure permissions Low3.2Aug 27 CVE-2026-59292No fix yet	Low3.2	No fix yet
Aug 27	VMware Spring Integration: tampering Medium6.6Aug 27 CVE-2026-59293No fix yet	Medium6.6	No fix yet
Aug 27	VMware Spring AI: path traversal Medium5.9Aug 27 CVE-2026-59294No fix yet	Medium5.9	No fix yet
Aug 27	VMware Spring Cloud Function: origin validation error Low3.1Aug 27 CVE-2026-59297No fix yet	Low3.1	No fix yet
Aug 27	VMware Spring Framework: code injection Medium6.1Aug 27 CVE-2026-59281No fix yet	Medium6.1	No fix yet
Aug 27	VMware Spring Framework: denial of service High7.5Aug 27 CVE-2026-59282No fix yet	High7.5	No fix yet
Aug 27	Applications that evaluate Spring Expression Language Critical9.1Aug 27 CVE-2026-59283No fix yet	Critical9.1	No fix yet
Aug 27	VMware Spring Cloud Commons: mass assignment High7.6Aug 27 CVE-2026-59284No fix yet	High7.6	No fix yet
Aug 27	VMware Spring for GraphQL: unsafe deserialization High8.1Aug 27 CVE-2026-59285No fix yet	High8.1	No fix yet
Aug 27	VMware Spring for GraphQL: code execution High8.1Aug 27 CVE-2026-59286No fix yet	High8.1	No fix yet
Aug 27	VMware Spring for GraphQL: denial of service Medium5.9Aug 27 CVE-2026-59287No fix yet	Medium5.9	No fix yet
Aug 27	Several components in Spring Security compare security-sensitive values using... Medium5.9Aug 27 CVE-2026-59276No fix yet	Medium5.9	No fix yet
Aug 27	VMware Spring Security: protection mechanism failure Low3.7Aug 27 CVE-2026-59277No fix yet	Low3.7	No fix yet
Aug 27	Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender Medium6.8Aug 27 CVE-2026-59272No fix yet	Medium6.8	No fix yet
Aug 27	VMware Spring Framework: path traversal Medium4.3Aug 27 CVE-2026-59280No fix yet	Medium4.3	No fix yet
Aug 27	VMware Spring Security: cross-site scripting Critical9.6Aug 27 CVE-2026-59354No fix yet	Critical9.6	No fix yet
Aug 27	VMware Spring Authorization Server: open redirect Medium6.1Aug 27 CVE-2026-59355No fix yet	Medium6.1	No fix yet
Aug 27	VMware Spring AMQP: unsafe deserialization Medium6.6Aug 27 CVE-2026-59275No fix yet	Medium6.6	No fix yet
Aug 27	VMware Spring for Apache Kafka: server-side request forgery Medium6.5Aug 27 CVE-2026-59278No fix yet	Medium6.5	No fix yet
Aug 27	VMware Spring Security: improper authorization Critical9.4Aug 27 CVE-2026-59270No fix yet	Critical9.4	No fix yet
Aug 27	VMware Spring AMQP: information disclosure in errors Medium5.3Aug 27 CVE-2026-59271No fix yet	Medium5.3	No fix yet
Aug 27	VMware Spring Integration: denial of service Medium6.5Aug 27 CVE-2026-59274No fix yet	Medium6.5	No fix yet
Aug 27	Spring MVC and WebFlux applications are vulnerable to stream corruption Critical9.8Aug 27 CVE-2026-47890No fix yet	Critical9.8	No fix yet
Aug 27	VMware Spring Framework: resource exhaustion Critical9.8Aug 27 CVE-2026-47891No fix yet	Critical9.8	No fix yet
Aug 27	VMware Spring Framework: improper authorization Critical9.8Aug 27 CVE-2026-47892No fix yet	Critical9.8	No fix yet
Aug 27	VMware Spring Framework: information disclosure in errors High7.5Aug 27 CVE-2026-47893No fix yet	High7.5	No fix yet
Aug 27	Spring Cloud Config Server native environment repository Medium4.9Aug 27 CVE-2026-47894No fix yet	Medium4.9	No fix yet
Aug 27	VMware Spring Framework: denial of service High7.5Aug 27 CVE-2026-47886No fix yet	High7.5	No fix yet
Aug 27	VMware Spring Framework: open redirect Medium6.1Aug 27 CVE-2026-47887No fix yet	Medium6.1	No fix yet
Aug 27	VMware Spring Framework: memory leak High7.5Aug 27 CVE-2026-47888No fix yet	High7.5	No fix yet
Aug 27	A WebFlux application running on the Jetty 12 Core reactive adapter serializes... High7.5Aug 27 CVE-2026-47889No fix yet	High7.5	No fix yet
Aug 27	VMware Spring Batch: resource exhaustion Medium5.9Aug 27 CVE-2026-47881No fix yet	Medium5.9	No fix yet
Aug 27	VMware Spring Framework: open redirect Medium6.1Aug 27 CVE-2026-47883No fix yet	Medium6.1	No fix yet

The newest 60. Each project page has the full list.

About VMware

VMware LLC is an American cloud computing and virtualization technology company headquartered in Palo Alto, California, U.S. On November 22, 2023, Broadcom acquired VMware in a cash-and-stock transaction valued at $69 billion, with the End-User Computing division of VMware then sold to KKR and rebranded to Omnissa.

Elsewhere on fru.dev: Paydays · TechConf

Critical advisories by email