58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
VMware vulnerabilities
1041 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-59311 | MED 6.8 | vmware spring_integration A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0. | 0.4% | — |
| CVE-2026-41707 | HIGH 7.4 | vmware spring_security Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing a | 0.4% | — |
| CVE-2017-4913 | HIGH 7.8 | vmware horizon_view VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Servi | 0.4% | — |
| CVE-2001-1059 | LOW 3.6 | vmware workstation VMWare creates a temporary file vmware-log.USERNAME with insecure permissions, which allows local users to read or modify license information. | 0.4% | — |
| CVE-2026-41843 | MED 5.9 | vmware spring_framework Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. | 0.4% | — |
| CVE-2020-3961 | HIGH 7.8 | vmware horizon_client VMware Horizon Client for Windows (prior to 5.4.3) contains a privilege escalation vulnerability due to folder permission configuration and unsafe loading of libraries. A local user on the system where the software is installed may exploit this issue to run co | 0.4% | — |
| CVE-2007-5671 | MED 4.4 | vmware ace HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly v | 0.4% | — |
| CVE-2020-4005 | HIGH 7.8 | vmware cloud_foundation VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within | 0.4% | — |
| CVE-2026-22737 | MED 5.9 | vmware spring_framework Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framewor | 0.4% | — |
| CVE-2023-20871 | HIGH 7.8 | vmware fusion VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system. | 0.4% | — |
| CVE-2018-6964 | HIGH 7.8 | vmware horizon_client VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to insecure usage of SUID binary. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on a | 0.4% | — |
| CVE-2017-4925 | MED 5.5 | vmware esxi VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x before 12.5.3), Fusion (8.x before 8.5.4) contain a NULL pointer dereference vulnerability. This iss | 0.4% | — |
| CVE-2016-7082 | HIGH 7.8 | vmware workstation_player VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memor | 0.4% | — |
| CVE-2011-1126 | MED 6.9 | vmware vix_api VMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7.1.4 build 385536 on Linux, might allow local users to gain privileges via a Trojan horse shared library in an unspecified directory. | 0.4% | — |
| CVE-2003-0631 | HIGH 7.2 | vmware gsx_server VMware GSX Server 2.5.1 build 4968 and earlier, and Workstation 4.0 and earlier, allows local users to gain root privileges via certain enivronment variables that are used when launching a virtual machine session. | 0.4% | — |
| CVE-2020-3999 | MED 6.5 | vmware esxi VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper i | 0.4% | — |
| CVE-2017-4950 | HIGH 7.0 | vmware fusion VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 | 0.4% | — |
| CVE-2008-2101 | LOW 2.1 | vmware esx The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line, which allows local users to obtain sensitive information by listing the process. | 0.4% | — |
| CVE-2020-3966 | HIGH 7.5 | vmware cloud_foundation VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a heap-overflow due to a race condition issue in the USB 2.0 contr | 0.4% | — |
| CVE-2010-2066 | MED 5.5 | canonical ubuntu_linux The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor. | 0.4% | — |
| CVE-2009-2899 | LOW 2.1 | vmware hyperic_hq The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments. | 0.4% | — |
| CVE-2026-59288 | HIGH 7.4 | vmware spring_for_graphql The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2 | 0.4% | — |
| CVE-2019-5511 | HIGH 8.8 | vmware workstation VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately. Successful exploitation of this issue may allow the path to the VMX executable, on a Windows host, to be hijacked by a non-administrator leading | 0.4% | — |
| CVE-2026-40966 | MED 5.9 | vmware spring_ai In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryA | 0.4% | — |
| CVE-2023-20870 | MED 6.0 | vmware fusion VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. | 0.4% | — |