Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
71 results · page 1 of 2
Jul 30, 2026VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.CVE-2026-59309 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter.CVE-2026-47876 · Other software · VMware · reported by security@vmware.comCritical 9.3
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability.CVE-2026-41703 · Other software · VMware · reported by security@vmware.comHigh 7.6
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or CVE-2026-41724 · Other software · VMware · reported by security@vmware.comHigh 8
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
- Product
- VCF operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or CVE-2026-41723 · Other software · VMware · reported by security@vmware.comHigh 8
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
- Product
- VCF operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or CVE-2026-41722 · Other software · VMware · reported by security@vmware.comHigh 8
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
- Product
- VCF operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write.CVE-2025-41237 · Other software · VMware · reported by security@vmware.comCritical 9.3
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025VMware Cloud Foundation contains a missing authorisation vulnerability.CVE-2025-41231 · Other software · VMware · reported by security@vmware.comHigh 7.3
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025VMware Cloud Foundation contains an information disclosure vulnerability.CVE-2025-41230 · Other software · VMware · reported by security@vmware.comHigh 7.5
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025VMware Cloud Foundation contains a directory traversal vulnerability.CVE-2025-41229 · Other software · VMware · reported by security@vmware.comHigh 8.2
VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024The vCenter Server contains a denial-of-service vulnerability.CVE-2024-37087 · Other software · VMware · reported by security@vmware.comMedium 5.3
The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Jun 25, 2024VMware ESXi contains an out-of-bounds read vulnerability.CVE-2024-37086 · Other software · VMware · reported by security@vmware.comMedium 6.8
VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
May 21, 2024The vCenter Server contains a partial file read vulnerability.CVE-2024-22275 · Other software · VMware · reported by security@vmware.comMedium 4.9
The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Mar 5, 2024VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller.CVE-2024-22255 · Other software · VMware · reported by security@vmware.comHigh 7.1
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023VMware Aria Operations contains a Local privilege escalation vulnerability.CVE-2023-20879 · Other software · VMware · reported by security@vmware.comMedium 6.7
VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023VMware Aria Operations contains a deserialization vulnerability.CVE-2023-20878 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023VMware Aria Operations contains a privilege escalation vulnerability.CVE-2023-20877 · Other software · VMware · reported by security@vmware.comHigh 8.8
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022VMware ESXi contains a heap-overflow vulnerability.CVE-2022-31699 · Other software · VMware · reported by security@vmware.comLow 3.3
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022The vCenter Server contains a denial-of-service vulnerability in the content library service.CVE-2022-31698 · Other software · VMware · reported by security@vmware.comMedium 5.3
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Dec 13, 2022VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket.CVE-2022-31696 · Other software · VMware · reported by security@vmware.comHigh 8.8
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability.CVE-2022-31678 · Other software · VMware · reported by security@vmware.comCritical 9.1
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022VMware ESXi contains a null-pointer deference vulnerability.CVE-2022-31681 · Other software · VMware · reported by security@vmware.comMedium 6.5
VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022The vCenter Server contains a server-side request forgery (SSRF) vulnerability.CVE-2022-22982 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information.CVE-2022-22961 · Other software · VMware · reported by security@vmware.comMedium 5.3
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability.CVE-2022-22959 · Other software · VMware · reported by security@vmware.comMedium 4.3
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).CVE-2022-22958 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).CVE-2022-22957 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 16, 2022VMware NSX Edge contains a CLI shell injection vulnerability.CVE-2022-22945 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy.CVE-2021-22050 · Other software · VMware · reported by security@vmware.comHigh 7.5
ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets.CVE-2021-22042 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller.CVE-2021-22041 · Other software · VMware · reported by security@vmware.comMedium 6.7
VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.CVE-2021-22040 · Other software · VMware · reported by security@vmware.comMedium 6.7
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC ManagCVE-2022-22939 · Other software · VMware · reported by security@vmware.comMedium 4.9
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-oCVE-2021-22045 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
Nov 24, 2021The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability.CVE-2021-21980 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.CVE-2021-22048 · Other software · VMware · reported by security@vmware.comHigh 8.8
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 13, 2021VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function.CVE-2021-22035 · Other software · VMware · reported by security@vmware.comMedium 4.3
VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log Insight which could be executed in user's environment.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2021Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.CVE-2021-22033 · Other software · VMware · reported by security@vmware.comLow 2.7
Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in the Analytics service.CVE-2021-22020 · Other software · VMware · reported by security@vmware.comMedium 5.5
The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service.CVE-2021-22019 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in.CVE-2021-22018 · Other software · VMware · reported by security@vmware.comMedium 6.5
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization.CVE-2021-22016 · Other software · VMware · reported by security@vmware.comMedium 6.1
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories.CVE-2021-22015 · Other software · VMware · reported by security@vmware.comHigh 7.8
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
Sep 23, 2021The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure).CVE-2021-22014 · Other software · VMware · reported by security@vmware.comHigh 7.2
The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API.CVE-2021-22013 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API.CVE-2021-22012 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library.CVE-2021-22011 · Other software · VMware · reported by security@vmware.comMedium 5.3
vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in VPXD service.CVE-2021-22010 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service.CVE-2021-22009 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service.CVE-2021-22008 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.