vmware

Latest CVEs · RSS

• CVE-2026-59347 2026-10-07 · CVSS 8.1
  VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual m
• CVE-2026-59346 2026-10-07 · CVSS 9.3
  VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET
• CVE-2026-59357 2026-10-06 · CVSS 6.5
  Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authen
• CVE-2026-59358 2026-10-06 · CVSS 7.6
  Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to
• CVE-2026-59341 2026-09-15 · CVSS 4.2
  A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go templat
• CVE-2026-47839 2026-09-11 · CVSS 9.2
  A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through
• CVE-2026-41012 2026-08-29 · CVSS 7.7
  Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API an
• CVE-2026-59324 2026-08-27 · CVSS 8.2
  When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageC
• CVE-2026-59322 2026-08-27 · CVSS 6.3
  The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payl
• CVE-2026-59321 2026-08-27 · CVSS 4.2
  A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the
• CVE-2026-59320 2026-08-27 · CVSS 6.5
  When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link
• CVE-2026-59319 2026-08-27 · CVSS 4.3
  RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(),
• CVE-2026-59317 2026-08-27 · CVSS 6.5
  DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Big
• CVE-2026-59316 2026-08-27 · CVSS 8.2
  Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker c
• CVE-2026-59315 2026-08-27 · CVSS 5.3
  The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0
• CVE-2026-59314 2026-08-27
  Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file
• CVE-2026-59311 2026-08-27 · CVSS 6.8
  A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer
• CVE-2026-59306 2026-08-27 · CVSS 3.1
  Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream
• CVE-2026-59313 2026-08-27
  Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0
• CVE-2026-59307 2026-08-27 · CVSS 8.0
  An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean
• CVE-2026-59305 2026-08-27 · CVSS 3.1
  Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2
• CVE-2026-59304 2026-08-27 · CVSS 3.1
  Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stre
• CVE-2026-59303 2026-08-27 · CVSS 3.1
  Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud St
• CVE-2026-59302 2026-08-27 · CVSS 3.1
  Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2
• CVE-2026-59301 2026-08-27 · CVSS 3.1
  Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functi