ESX insufficient logging vulnerability

Out-of-bounds read vulnerability

VMXNET3 out-of-bounds write vulnerability

vCenter authentication-bypass vulnerability

vCenter directory-traversal vulnerability

VMware Aria Operations privilege escalation vulnerability

Username enumeration vulnerability

Weak password recovery vulnerability

Header injection vulnerability

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

Denial-of-service vulnerability

vSockets information-disclosure vulnerability

PVSCSI heap-overflow vulnerability

VMCI integer-underflow vulnerability

VMXNET3 integer-overflow vulnerability

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.

VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.

VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.

VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

Denial-of-Service Vulnerability

Guest Operations Denial-of-Service Vulnerability

VMware vCenter Server authenticated command-execution vulnerability

VMware Cloud Foundation Information Disclosure Vulnerability

VMware Cloud Foundation Directory Traversal Vulnerability

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this …

VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

VMware NSX contains a content spoofing vulnerability.  An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure.

VMware NSX contains a local privilege escalation vulnerability.  An authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned.