By vendor

Vmware vulnerabilities

Known CVEs affecting Vmware products, prioritized by severity, with SEC.co remediation and detection guidance.

47 published vulnerabilities

• CVE-2026-47835HIGH 8.6

  Spring AI's vector store implementations for Elasticsearch, OpenSearch, and GemFire contain a query injection vulnerability. An attacker can inject specially crafted characters into vector store queries to execute arbitrary database operations without authentication. This affects Spring AI versions 1.0.0–1.0.8 and 1.1.0–1.1.7, with fixes available in 1.0.9 and 1.1.8 respectively.

• CVE-2026-41699HIGH 8.1

  Spring for GraphQL applications that use pagination features are vulnerable to a deserialization attack that can allow remote code execution. An attacker sends a specially crafted GraphQL query to a paginated endpoint; if the application's runtime environment contains certain gadget classes, the attack can execute arbitrary code on the server. The vulnerability affects Spring for GraphQL versions 1.3.0–1.3.8, 1.4.0–1.4.5, and 2.0.0–2.0.3.

• CVE-2026-41700HIGH 8.1

  Spring for GraphQL applications using WebSocket transport have a Cross-Site WebSocket Hijacking vulnerability. An attacker can craft a malicious webpage that, when visited by an authenticated user, hijacks that user's WebSocket connection and executes arbitrary GraphQL queries or mutations on their behalf. The victim's session credentials are automatically sent with WebSocket requests, making them a natural target for this type of attack. This is particularly dangerous because it requires minimal user interaction—just visiting a page—and gives attackers full access to perform any GraphQL operation the victim is authorized to perform.

• CVE-2026-41717HIGH 8.1

  Spring Data MongoDB has a vulnerability where specially crafted database queries can execute arbitrary code on your application server. This happens when developers use the @Query annotation with certain placeholder patterns in their custom repository methods. An attacker who can influence the query parameters—either through application input or by compromising a data source—can inject malicious expressions that the framework will execute with your application's privileges.

• CVE-2026-41729HIGH 8.1

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, contains a vulnerability in how it processes JSON Patch requests when entities include Map-type properties. An authenticated attacker can inject malicious SpEL (Spring Expression Language) expressions by crafting a specially formatted JSON Patch request. The framework fails to sanitize the map key derived from the JSON Pointer path, allowing the attacker to execute arbitrary code on the server. This requires valid credentials but no additional user interaction to exploit.

• CVE-2026-41731HIGH 8.1

  Spring for Apache Kafka contains a flaw in how it validates trusted message header types. When a developer trusts a package for deserialization, the framework actually trusts that entire package and all of its subpackages. An attacker who can produce Kafka messages can exploit this overly broad trust to craft malicious header values that force the consumer to deserialize and instantiate arbitrary JDK classes. Combined with Jackson's default deserialization behavior, this can lead to remote code execution on systems processing the poisoned messages.

• CVE-2026-41732HIGH 8.1

  A flaw in Spring for Apache Pulsar's type-header validation allows an attacker to deserialize untrusted Java objects when the library is configured with a trusted-packages allowlist. The vulnerability has two related problems: first, trusting a package name implicitly trusts all of its subpackages due to a prefix-matching check, and second, an empty trusted-packages configuration defaults to trusting all packages instead of safely rejecting unknown types. An attacker on the network can exploit this by sending specially crafted messages to deserialize malicious objects, potentially leading to remote code execution.

• CVE-2026-41855HIGH 8.1

  Spring Framework's JMS message converters contain a deserialization flaw that allows attackers to instantiate arbitrary classes when processing untrusted messages from a JMS broker. An attacker with access to a JMS broker—or one who can inject malicious messages into it—can exploit gadget classes present on the application's classpath to execute unauthorized actions, including potential remote code execution. The vulnerability affects multiple recent versions of Spring Framework across several release branches.

• CVE-2026-41722HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated attackers with policy creation, view, or text-widget privileges to inject malicious scripts. These scripts execute in the context of administrative actions within VMware Cloud Foundation Operations, potentially allowing attackers to perform unauthorized administrative operations. The vulnerability requires user interaction (such as an administrator viewing a malicious policy or widget) but can have significant impact once triggered.

• CVE-2026-41723HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions. The vulnerability requires an attacker to have legitimate access credentials and user interaction to succeed, but poses significant risk to organizations running affected VMware infrastructure management platforms.

• CVE-2026-41724HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions without additional authentication. The vulnerability requires both authentication and user interaction (clicking a link or visiting a crafted page), but once triggered, grants full administrative capability within the affected platform.

• CVE-2026-41003HIGH 7.6

  A vulnerability in Spring Security allows attackers who can control certain configuration values to inject and execute arbitrary code within HTML forms generated by the framework's security filters. The attack requires that an attacker first gain the ability to modify RelyingPartyRegistration settings—typically through compromised credentials, misconfigured access controls, or supply-chain interference—and then trick a user into interacting with a malicious form. Once the malicious code executes in the user's browser, the attacker can steal session tokens, harvest credentials, or perform actions on behalf of the victim.

• CVE-2026-40988HIGH 7.5

  Spring Security's SAML 2.0 login and logout functionality has a flaw in how it handles compressed SAML messages sent via the REDIRECT binding. An attacker can send a specially crafted compressed payload that, when decompressed by the application, consumes excessive memory and causes the application to become unavailable. This is a denial-of-service attack that requires no authentication and can be triggered remotely by anyone with network access to the affected application.

• CVE-2026-41006HIGH 7.5

  Spring HATEOAS contains a flaw in how it processes certain API response formats (Collection+JSON and UBER). When deserializing these formats, the library uses an internal method that bypasses Jackson's security controls, allowing it to bind properties to Java objects without respecting restrictions that developers have intentionally put in place. This can be exploited to set properties that shouldn't be settable, potentially causing availability issues.

• CVE-2026-41007HIGH 7.5

  Spring HATEOAS, a widely used library for building REST APIs with hypermedia support, contains a denial-of-service vulnerability stemming from an unbound cache. Attackers can exploit this by sending specially crafted requests that cause the application to accumulate StringLinkRelation objects indefinitely, eventually exhausting memory and crashing the service. The vulnerability affects multiple versions across the 1.5, 2.3, 2.4, 2.5, and 3.0 release lines.

• CVE-2026-41728HIGH 7.5

  Spring Data REST, a widely-used framework for building REST APIs on top of Spring Data repositories, contains an authorization bypass vulnerability in its JSON Patch implementation. When processing JSON Patch requests (which use the application/json-patch+json content type), the framework fails to properly enforce write-access restrictions on intermediate steps of multi-level object paths. This means an attacker can craft a malicious patch request that modifies protected fields by traversing through intermediate objects without the framework validating permissions at each step. The vulnerability affects a broad range of versions across multiple release lines, potentially impacting many Spring-based microservices and REST APIs.

• CVE-2026-41842HIGH 7.5

  Spring Framework versions 5.3 through 7.0 contain a denial-of-service vulnerability in their static resource resolution code. An unauthenticated attacker can craft requests that cause Spring MVC and WebFlux applications to consume excessive resources, potentially rendering the application unavailable. No user interaction is required, and the attack works over the network. The vulnerability affects a wide range of Spring versions released over several years, making it relevant to many production deployments.

• CVE-2026-41849HIGH 7.5

  Spring Framework versions 5.3.0 through 5.3.48 contain an integer overflow flaw in the Spring Expression Language (SpEL) evaluation engine. By crafting a malicious SpEL expression, an unauthenticated attacker can trigger uncontrolled resource consumption on the affected system, leading to denial of service. No authentication is required, and the attack can be mounted remotely over the network.

• CVE-2026-41850HIGH 7.5

  Spring Framework contains a vulnerability in how it evaluates user-supplied SpEL (Spring Expression Language) expressions. An attacker can craft a malicious expression that forces the application to consume excessive CPU or memory during processing, causing the application to slow down or become completely unavailable. This only affects applications that directly evaluate untrusted SpEL input—not all Spring applications are vulnerable. The vulnerability impacts multiple recent versions of Spring Framework across the 5.3, 6.1, 6.2, and 7.0 release lines.

• CVE-2026-41856HIGH 7.5

  Spring for GraphQL has a flaw in how it detects security annotations on data fetcher methods. When methods are inherited or defined in type hierarchies, the framework may fail to recognize authorization annotations at runtime, allowing requests that should be blocked by security rules to proceed. This affects multiple versions across the 1.x and 2.x release lines.

• CVE-2026-40993HIGH 7.3

  Spring Security versions 7.0.0 through 7.0.5 contain a deserialization vulnerability in how they manage SAML metadata. An attacker who has write access to specific database tables can insert malicious serialized code into credential storage columns. When the application deserializes this data, it executes the attacker's payload. This requires existing database write privileges, but the impact can be severe—potentially allowing unauthorized access or system manipulation.

• CVE-2026-41845HIGH 7.1

  Spring Framework contains a flaw in its JavaScriptUtils.javaScriptEscape() function that fails to properly escape certain characters. This weakness allows attackers to inject malicious JavaScript code that executes in users' browsers, potentially stealing session data, credentials, or performing actions on behalf of the user. The vulnerability requires user interaction—specifically clicking a malicious link or visiting a compromised page—but does not require authentication. Multiple versions of Spring Framework across the 5.3, 6.1, 6.2, and 7.0 release lines are affected.

• CVE-2026-47838MEDIUM 6.8

  Spring Security contains a flaw in how it processes X.509 certificate subject names (the DN field used for authentication). When a certificate contains a specially crafted Common Name (CN) value, Spring Security may misread it and extract the wrong username. An authenticated attacker could exploit this by presenting a malformed certificate to impersonate another user. The vulnerability affects multiple Spring Security versions across the 5.7, 5.8, 6.3, 6.4, and 6.5 release lines.

• CVE-2026-41726MEDIUM 6.5

  Spring for Apache Kafka applications that have enabled DelegatingDeserializer are vulnerable to a resource exhaustion attack where an authenticated attacker can send specially crafted Kafka messages containing random header values. The application will consume increasing amounts of heap memory without releasing it, eventually exhausting available memory and causing the application to crash or become unresponsive.

• CVE-2026-41727MEDIUM 6.5

  Spring for Apache Kafka contains a vulnerability in how it validates header information when processing message retries. An authenticated user can craft a malicious Kafka message with an artificially high or invalid retry attempt count in a header, causing the retry routing system to become confused about where that message sits in the retry sequence. This confusion can disrupt message delivery logic and potentially cause the system to become unavailable, though attackers need valid Kafka producer credentials to exploit it.

• CVE-2026-41008MEDIUM 6.1

  Spring Security Authorization Server contains an open redirect vulnerability in its authorization endpoint. When processing OAuth 2.0 authorization requests, the server insufficiently validates the request_uri parameter, allowing an attacker to combine an invalid request_uri with a crafted redirect_uri to redirect users to an attacker-controlled website after authentication. This affects Spring Security versions 7.0.0–7.0.5 and Spring Authorization Server versions 1.5.0–1.5.7.

• CVE-2026-41706MEDIUM 6.1

  Spring Security's request caching mechanisms (CookieRequestCache and CookieServerRequestCache) contain an open redirect vulnerability. These components store the URL users intended to visit before logging in, then redirect them there after successful authentication. The vulnerability exists because the stored URL is not validated before being used as a redirect target, allowing attackers to craft malicious login links that redirect authenticated users to arbitrary external websites. An attacker could exploit this to perform phishing attacks, credential harvesting, or malware distribution by tricking users into clicking a specially crafted link.

• CVE-2026-41696MEDIUM 5.9

  Spring Data MongoDB, a widely-used persistence framework for MongoDB, contains a query injection vulnerability affecting multiple versions. When developers use the @Query annotation with regex parameter binding, the framework fails to properly validate user-supplied input. This allows an attacker to craft a malicious string that escapes the intended regex boundaries and inject arbitrary queries. The vulnerability does not currently appear on the CISA KEV catalog, but the broad version range affected and the sensitive nature of database queries make it a meaningful risk for organizations relying on Spring Data MongoDB.

• CVE-2026-41840MEDIUM 5.9

  Spring WebFlux applications running affected versions of Spring Framework contain a denial-of-service vulnerability triggered by specially crafted multipart requests. An unauthenticated remote attacker can exploit this to disrupt application availability without requiring special network access or user interaction. The vulnerability affects a wide range of Spring Framework versions spanning multiple release lines, making it broadly relevant to organizations using Spring-based web services.

• CVE-2026-41841MEDIUM 5.9

  Spring MVC and WebFlux applications contain a vulnerability that can leak sensitive information through improper handling of static resource requests. An attacker can craft requests to bypass normal access controls and read files that should be protected, though successful exploitation requires specific conditions. The vulnerability affects multiple Spring Framework versions across several release lines.

• CVE-2026-41843MEDIUM 5.9

  Spring Framework applications that serve static resources through MVC or WebFlux are vulnerable to path traversal attacks. An attacker can craft malicious requests to access files outside the intended static resource directory, potentially reading sensitive configuration files, source code, or other protected assets. This vulnerability affects multiple recent versions of Spring Framework across all actively maintained branches.

• CVE-2026-41846MEDIUM 5.9

  Spring Framework contains a reflected cross-site scripting (XSS) vulnerability in its JSP form tag library. When developers use Spring MVC form tags and bind user-supplied input to the cssClass, cssErrorClass, or cssStyle attributes without proper sanitization, an attacker can inject malicious HTML and JavaScript code. This code executes in the victim's browser when they view the affected page, potentially allowing credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (such as clicking a malicious link) to trigger.

• CVE-2026-40989MEDIUM 5.7

  Spring Cloud Function versions across multiple release lines contain a flaw in the routing layer that can trigger infinite recursion during request handling. This recursion exhausts available memory, causing an out-of-memory (OOM) error that crashes the application. The vulnerability requires either physical access to the system or authenticated local access to exploit, which limits its immediate risk in cloud-native deployments but remains a concern for containerized environments or systems with weak internal network segmentation.

• CVE-2026-40990MEDIUM 5.7

  A resource exhaustion flaw exists in Spring Cloud Function that allows an attacker to trigger out-of-memory (OOM) errors by registering an excessive number of functions in the Function Registry. The vulnerability requires local or adjacent network access and user interaction, making it a medium-severity concern primarily affecting development and hybrid deployment environments. Multiple versions across Spring Cloud Function 3.2 through 5.0 are vulnerable.

• CVE-2026-41730MEDIUM 5.3

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, has a flaw where detailed error messages—including information from the underlying database layer—are exposed directly to API clients. When an exception occurs during request processing, the full chain of causes is serialized into HTTP error responses. This means a remote attacker can trigger exceptions and receive detailed stack traces and system internals that should remain hidden. The vulnerability affects multiple versions across the 3.7, 4.3, 4.4, 4.5, and 5.0 release lines.

• CVE-2026-41837MEDIUM 5.3

  Spring Data REST's filtering feature bypasses Jackson customizations when processing user-supplied filter parameters, potentially allowing attackers to access sensitive object properties that should be restricted. An unauthenticated attacker can craft malicious filter requests to extract unauthorized information from the application's data layer without modifying or disrupting service.

• CVE-2026-41851MEDIUM 5.3

  Spring Framework contains a vulnerability in how it handles Spring Expression Language (SpEL) expressions when applications allow user input to be evaluated as SpEL code. An attacker can craft specially designed expressions that cause the framework's internal cache to grow without bounds, consuming memory until the application becomes unresponsive or crashes. This is a denial-of-service (DoS) condition that requires no authentication and can be triggered remotely.

• CVE-2026-41853MEDIUM 5.3

  Spring Framework versions 5.3.0 through 7.0.7 contain a vulnerability allowing attackers to perform multipart request smuggling attacks. This vulnerability lets unauthenticated remote attackers craft malformed multipart HTTP requests that can be interpreted differently by intermediate proxies or load balancers versus the Spring application itself, potentially leading to request confusion and unauthorized actions. No user interaction is required, and the vulnerability affects both Spring MVC and WebFlux application handlers.

• CVE-2026-41838MEDIUM 4.8

  Spring Framework's WebSocket session management generates predictable IDs instead of using cryptographic randomness. An attacker with valid login credentials could potentially guess or enumerate these session identifiers and, when combined with weak authorization controls, gain unauthorized access to other users' WebSocket sessions to view sensitive data. The vulnerability requires both authentication and specific authorization gaps to exploit, making it a moderate-risk issue requiring immediate attention in security-sensitive deployments.

• CVE-2026-41847MEDIUM 4.8

  Spring WebFlux applications using Kotlin Router DSL are vulnerable to a security bypass that could allow an attacker to circumvent intended access controls. The issue affects Spring Framework versions 5.3.0 through 5.3.48 and requires specific configuration conditions to exploit, making it a moderate-severity concern for teams running these versions in production.

• CVE-2026-41839MEDIUM 4.2

  Spring Framework versions 5.3, 6.1, 6.2, and 7.0 contain a session management flaw in WebFlux applications. If an attacker first compromises a subdomain (through XSS or similar attack), they can trade a known session ID for one belonging to an authenticated user, potentially gaining unauthorized access to that user's account or data. The flaw requires two conditions: initial subdomain compromise and user interaction, which limits its immediate exploitability but remains a meaningful risk in multi-tenant or loosely-segmented environments.

• CVE-2026-41844MEDIUM 4.2

  CVE-2026-41844 is a redirect vulnerability in Spring Framework that allows attackers to craft malicious links causing users' browsers to redirect to arbitrary external websites. The flaw exists in Spring MVC and Spring WebFlux applications configured with a catch-all URL mapping ("/**") where the view name is not explicitly set. An attacker can exploit the 'redirect:' prefix to bypass intended routing controls and send users to phishing sites or other malicious hosts. This requires user interaction—the victim must click a crafted link—and impacts four widely-used versions of Spring Framework spanning multiple release series.

• CVE-2026-41854MEDIUM 4.2

  CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in Spring Framework caused by incorrect parsing of host names in URLs. When an application uses Spring's UriComponentsBuilder to process a URL provided by an external user, an attacker could craft a malicious URL that causes the application to make unintended requests to internal systems or services. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. Exploitation requires user interaction and presents moderate risk.

• CVE-2026-41714MEDIUM 4.0

  Spring AMQP applications that connect to RabbitMQ brokers using AMQPS URIs without explicitly enabling SSL validation are vulnerable to man-in-the-middle attacks. While the connection appears encrypted, the application skips critical TLS certificate and hostname verification steps, allowing an attacker to intercept credentials and sensitive message data. This occurs when developers configure RabbitConnectionFactoryBean with an amqps:// URI but omit the setUseSSL(true) call, creating a false sense of security.

• CVE-2026-41694LOW 3.7

  Spring Security's SAML module decrypts encrypted SAML messages without first verifying they contain a valid digital signature. An attacker can craft malicious SAML responses or logout messages, send them to a vulnerable application, and observe how the application behaves when decrypting attacker-controlled data. By analyzing these responses, an attacker could potentially extract encryption keys or other sensitive information that the application decrypts. This is a low-severity issue because exploitation requires specific conditions and yields limited information exposure.

• CVE-2026-41848LOW 3.7

  Spring Framework's AntPathMatcher component is susceptible to a Regular Expression Denial of Service (ReDoS) attack. If an attacker can control or influence URL path patterns processed by the matcher, they can craft a malicious pattern that causes excessive CPU consumption, potentially degrading application performance or availability. This vulnerability affects multiple actively supported versions of Spring Framework spanning several release lines.

• CVE-2026-41852LOW 3.7

  Spring Expression Language (SpEL) in VMware Spring Framework contains a flaw that allows attackers to invoke arbitrary methods with zero arguments even in contexts designed to restrict or prevent such actions. An attacker with network access could exploit this to trigger unintended application logic, potentially leading to denial of service or information disclosure depending on available methods and application design. This affects multiple versions across the 5.3, 6.1, 6.2, and 7.0 release branches.