By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited VMware flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-22226 VMware ESXi, Workstation, and Fusion Information DisclosureExploited since Mar 4, 2025 · CVSS 7.1
- CVE-2025-22225 VMware ESXi Arbitrary WriteExploited since Mar 4, 2025 · ransomware · CVSS 8.2
- CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race ConditionExploited since Mar 4, 2025 · CVSS 9.3
- CVE-2024-38813 VMware vCenter Server Privilege EscalationExploited since Nov 20, 2024 · CVSS 7.5
- CVE-2024-38812 VMware vCenter Server Heap-Based Buffer OverflowExploited since Nov 20, 2024 · CVSS 9.8
- CVE-2024-37085 VMware ESXi Authentication BypassExploited since Jul 30, 2024 · ransomware · CVSS 6.8
- CVE-2022-22948 VMware vCenter Server Incorrect Default File Permissions Vulnerability Exploited since Jul 17, 2024 · CVSS 6.5
- CVE-2023-34048 VMware vCenter Server Out-of-Bounds WriteExploited since Jan 22, 2024 · CVSS 9.8
- CVE-2023-20867 VMware Tools Authentication BypassExploited since Jun 23, 2023 · CVSS 3.9
- CVE-2023-20887 Vmware Aria Operations for Networks Command InjectionExploited since Jun 22, 2023 · CVSS 9.8
- CVE-2022-22947 VMware Spring Cloud Gateway Code InjectionExploited since May 16, 2022 · CVSS 10
- CVE-2022-22960 VMware Multiple Products Privilege EscalationExploited since Apr 15, 2022 · CVSS 7.8
- CVE-2022-22954 VMware Workspace ONE Access and Identity Manager Server-Side Template InjectionExploited since Apr 14, 2022 · ransomware · CVSS 9.8
- CVE-2022-22965 Spring Framework JDK 9+ Remote Code ExecutionExploited since Apr 4, 2022 · CVSS 9.8
- CVE-2018-6961 VMware SD-WAN Edge by VeloCloud Command InjectionExploited since Mar 25, 2022 · CVSS 8.1
- CVE-2021-21973 VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF)Exploited since Mar 7, 2022 · CVSS 5.3
- CVE-2021-21975 VMware Server Side Request Forgery in vRealize Operations Manager APIExploited since Jan 18, 2022 · ransomware · CVSS 7.5
- CVE-2021-22017 VMware vCenter Server Improper Access ControlExploited since Jan 10, 2022 · CVSS 5.3
- CVE-2021-22005 VMware vCenter Server File UploadExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2020-3992 VMware ESXi OpenSLP Use-After-FreeExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2020-3952 VMware vCenter Server Information DisclosureExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2020-3950 VMware Multiple Products Privilege EscalationExploited since Nov 3, 2021 · CVSS 7.8
- CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer OverflowExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2020-4006 Multiple VMware Products Command InjectionExploited since Nov 3, 2021 · CVSS 9.1
- CVE-2021-21985 VMware vCenter Server Improper Input ValidationExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2021-21972 VMware vCenter Server Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
Latest high and critical flaws
- CVE-2026-59347 VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS.High 8.1 · Oct 7, 2026
- CVE-2026-59346 VMware Workstation and Fusion contain an integer-overflow vulnerability.Critical 9.3 · Oct 7, 2026
- CVE-2026-59309 VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.Critical 9.8 · Jul 30, 2026
- CVE-2026-47876 VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter.Critical 9.3 · Jul 30, 2026
- CVE-2026-41703 VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability.High 7.6 · Jul 30, 2026
- CVE-2026-47871 VMware Avi Load Balancer contains a directory traversal vulnerability.High 8.8 · Jul 18, 2026
- CVE-2026-47870 VMware Avi Load Balancer contains a privilege escalation vulnerability.High 7.1 · Jul 18, 2026
- CVE-2026-47869 VMware Avi Load Balancer contains a remote code execution vulnerability.High 8.7 · Jul 18, 2026
- CVE-2026-47868 VMware Avi Load Balancer contains a local privilege escalation vulnerability.High 7.8 · Jul 18, 2026
- CVE-2026-47867 VMware Avi Load Balancer contains a remote code execution vulnerability.High 8.7 · Jul 18, 2026
- CVE-2026-47866 VMware Avi Load Balancer contains an authorization bypass vulnerability.High 8.3 · Jul 18, 2026
- CVE-2026-47865 VMware Avi Load Balancer contains an authentication bypass vulnerability.Critical 9.8 · Jul 18, 2026
- CVE-2026-41724 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or High 8 · Jun 8, 2026
- CVE-2026-41723 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or High 8 · Jun 8, 2026
- CVE-2026-41722 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or High 8 · Jun 8, 2026
- CVE-2026-41702 VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary.High 7.8 · May 15, 2026
- CVE-2026-41713 A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way.High 8.2 · May 12, 2026
- CVE-2026-41712 Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.High 7.5 · May 12, 2026
- CVE-2026-22750 When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the defauHigh 7.5 · Apr 10, 2026
- CVE-2026-22732 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be writtCritical 9.1 · Mar 19, 2026
- CVE-2026-22730 A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbHigh 8.8 · Mar 18, 2026
- CVE-2026-22729 A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through High 8.6 · Mar 18, 2026
- CVE-2026-22720 VMware Aria Operations contains a stored cross-site scripting vulnerability.High 8 · Feb 25, 2026
- CVE-2026-2818 A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction dirHigh 8.2 · Feb 20, 2026
- CVE-2025-41253 The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackerHigh 7.5 · Oct 16, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.