VMware
Number 73 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: VMWare, VMware, vmware
Total vulnerabilities
241
Critical
15
High
53
Known Exploited
8
Exploit available
5
Network, no login needed
31.0%
Of 116 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 39 | 6 | 20 | 9 | 4 | 0 |
| 2025 | 51 | 7 | 20 | 22 | 2 | 0 |
| 2024 | 13 | 1 | 7 | 4 | 1 | 0 |
| 2023 | 12 | 1 | 5 | 5 | 1 | 0 |
| 2022 | 2 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 23 | 0 | 0 | 0 | 0 | 23 |
| 2019 | 21 | 0 | 0 | 0 | 0 | 21 |
| 2018 | 34 | 0 | 1 | 0 | 0 | 33 |
| 2017 | 46 | 0 | 0 | 0 | 0 | 46 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Workstation | 24 | 1 |
| ESXi | 23 | 4 |
| VMware ESXi | 14 | 0 |
| SALT | 11 | 3 |
| VMware Aria Operations | 10 | 6 |
| Avi Load Balancer | 8 | 7 |
| Cloud Foundation | 8 | 7 |
| Spring Framework | 7 | 1 |
| Workstation Pro/Player | 6 | 0 |
| vCenter Server | 6 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 14 | 7 |
| Path Traversal | 11 | 6 |
| Memory Corruption | 10 | 7 |
| Privilege Escalation | 8 | 5 |
| Authentication Issues | 7 | 3 |
| Command Injection | 6 | 5 |
| Denial of Service | 5 | 0 |
| Information Disclosure | 4 | 2 |
| Race Condition | 3 | 2 |
| SQL Injection | 3 | 2 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-59310 | vCenter directory-traversal vulnerability | Critical | 61.7% | |
| CVE-2026-41709 | ESX insufficient logging vulnerability | Low | 0.7% | |
| CVE-2026-22719 | VMware Aria Operations command injection vulnerability | High | 18.3% | |
| CVE-2025-41244 | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) | High | 16.4% | |
| CVE-2025-22224 | VMware ESXi: Race Condition | Critical | 1.6% | |
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | Critical | 99.2% | |
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | Low | 13.6% | |
| CVE-2018-6961 | VMware NSX SD-WAN by VeloCloud: Command Injection | High | 85.5% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-59347 | VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability | High | 0.2% | |
| CVE-2026-59346 | VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability | Critical | 0.4% | |
| CVE-2026-59355 | Spring Authorization Server: Open Redirect via request_uri parameter | Medium | 0.2% | |
| CVE-2026-59310 | vCenter directory-traversal vulnerability | Critical | 61.7% | |
| CVE-2026-59309 | vCenter authentication-bypass vulnerability | Critical | 0.6% | |
| CVE-2026-47876 | VMXNET3 out-of-bounds write vulnerability | Critical | 0.2% | |
| CVE-2026-41709 | ESX insufficient logging vulnerability | Low | 0.7% | |
| CVE-2026-41703 | Out-of-bounds read vulnerability | High | 0.4% | |
| CVE-2026-47871 | VMware Avi Load Balancer Directory Traversal Vulnerability | High | 1.0% | |
| CVE-2026-47870 | VMware Avi Load Balancer Privilege Escalation Vulnerability | High | 0.4% |