CVE Tools
Track your stack

VMware

917 CVEs tracked since 2000. Since Oct 2018, 26 of them reached CISA KEV.

VMware CVEs per month

Oct 2018 to Aug 2026. Point at a month, or focus the strip and use the arrow keys.
VMware CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-1040
2018-11null or fewer
2018-1240
2019-01null or fewer
2019-02null or fewer
2019-03null or fewer
2019-04null or fewer
2019-0520
2019-06null or fewer
2019-07null or fewer
2019-08null or fewer
2019-0940
2019-1070
2019-1140
2019-1231
2020-0150
2020-0230
2020-0361
2020-04null or fewer
2020-05null or fewer
2020-06131
2020-07null or fewer
2020-0830
2020-0980
2020-10111
2020-11101
2020-12null or fewer
2021-01null or fewer
2021-0262
2021-03null or fewer
2021-04null or fewer
2021-0581
2021-0670
2021-0730
2021-08100
2021-09202
2021-10100
2021-1160
2021-1231
2022-0130
2022-0270
2022-0382
2022-04164
2022-0580
2022-0660
2022-0750
2022-08180
2022-09null or fewer
2022-1070
2022-11110
2022-12110
2023-0150
2023-0270
2023-03null or fewer
2023-04111
2023-0570
2023-06102
2023-0750
2023-0860
2023-09null or fewer
2023-10141
2023-11null or fewer
2023-12null or fewer
2024-01null or fewer
2024-02110
2024-0360
2024-04null or fewer
2024-0590
2024-0682
2024-07null or fewer
2024-08null or fewer
2024-09null or fewer
2024-10null or fewer
2024-1150
2024-12null or fewer
2025-0160
2025-02null or fewer
2025-03null or fewer
2025-04null or fewer
2025-05100
2025-06160
2025-0770
2025-08null or fewer
2025-0981
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-01null or fewer
2026-0291
2026-03110
2026-04261
2026-0590
2026-06440
2026-07130
2026-08640

Products

The products that kept showing up in VMware's monthly top three, with their CVEs summed over those months.

  1. Cloud Foundation11326 months
  2. ESXi4817 months
  3. Fusion4715 months
  4. Vcenter Server387 months
  5. Workstation3412 months
  6. Spring Framework324 months
  7. Spring Security266 months
  8. Identity Manager193 months
  9. Telco Cloud Platform174 months
  10. Spring AI153 months

Latest CVEs

The 15 most recently published vulnerabilities affecting VMware.

  1. CVE-2026-59324fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction8.2
  2. CVE-2026-59322EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders6.3
  3. CVE-2026-59321Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check4.2
  4. CVE-2026-59320In Spring AMQP the link credit never replenished on listener exception path6.5
  5. CVE-2026-59317In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop6.5
  6. CVE-2026-59319RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure4.3
  7. CVE-2026-59315Spring Cloud Config Monitor Denial of Service5.3
  8. CVE-2026-59314Spring Framework response splitting in ContentDisposition3.7
  9. CVE-2026-59311Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation6.8
  10. CVE-2026-59306Potential for deserialization of untrusted types in Spring Cloud Stream3.1
  11. CVE-2026-59313Server Sent Event stream corruption in Spring MVC functional web framework9.8
  12. CVE-2026-59307Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference8.0
  13. CVE-2026-59305Partition interceptor may be improperly added while sending message3.1
  14. CVE-2026-59304Improper caching of the original content type in Spring Cloud Stream Avro3.1
  15. CVE-2026-59303Dynamic destination cache size is not properly bound in Spring Cloud Stream3.1

The record

Peak rank
#8 in Apr 2010
Busiest month shown
Aug 2026, 64 CVEs
Months with a KEV entry
18 since Oct 2018
Monthly snapshots
155 since 2000
VMware's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store