CVE Tools
Track your stack

VMware

917 CVEs tracked since 2000. Since Oct 2018, 26 of them reached CISA KEV.

VMware CVEs per month

Oct 2018 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
VMware CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-1040
2018-11no snapshot
2018-1240
2019-01no snapshot
2019-021 or fewer
2019-03no snapshot
2019-04no snapshot
2019-0520
2019-06no snapshot
2019-072 or fewer
2019-082 or fewer
2019-0940
2019-1070
2019-1140
2019-1231
2020-0150
2020-0230
2020-0361
2020-04no snapshot
2020-05no snapshot
2020-06131
2020-07no snapshot
2020-0830
2020-0980
2020-10111
2020-11101
2020-122 or fewer
2021-012 or fewer
2021-0262
2021-03no snapshot
2021-042 or fewer
2021-0581
2021-0670
2021-0730
2021-08100
2021-09202
2021-10100
2021-1160
2021-1231
2022-0130
2022-0270
2022-0382
2022-04164
2022-0580
2022-0660
2022-0750
2022-08180
2022-093 or fewer
2022-1070
2022-11110
2022-12110
2023-0150
2023-0270
2023-03no snapshot
2023-04111
2023-0570
2023-06102
2023-0750
2023-0860
2023-093 or fewer
2023-10141
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-02110
2024-0360
2024-044 or fewer
2024-0590
2024-0682
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-1150
2024-123 or fewer
2025-0160
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-05100
2025-06160
2025-0770
2025-084 or fewer
2025-0981
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-0291
2026-03110
2026-04261
2026-0590
2026-06440
2026-07130
2026-08640
2026-099 or fewer
2026-1011 or fewer
2026-110

Products

The products that kept showing up in VMware's monthly top three, with their CVEs summed over those months.

  1. Cloud Foundation11326 months
  2. ESXi4817 months
  3. Fusion4715 months
  4. Vcenter Server387 months
  5. Workstation3412 months
  6. Spring Framework324 months
  7. Spring Security266 months
  8. Identity Manager193 months
  9. Telco Cloud Platform174 months
  10. Spring AI153 months

Latest CVEs

The 15 most recently published vulnerabilities affecting VMware.

  1. CVE-2026-59347VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability8.1
  2. CVE-2026-59346VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability9.3
  3. CVE-2026-106123RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()5.5
  4. CVE-2026-106122RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers7.5
  5. CVE-2026-106121RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS4.9
  6. CVE-2026-59324fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction8.2
  7. CVE-2026-59322EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders6.3
  8. CVE-2026-59321Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check4.2
  9. CVE-2026-59320In Spring AMQP the link credit never replenished on listener exception path6.5
  10. CVE-2026-59319RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure4.3
  11. CVE-2026-59317In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop6.5
  12. CVE-2026-59315Spring Cloud Config Monitor Denial of Service5.3
  13. CVE-2026-59314Spring Framework response splitting in ContentDisposition3.7
  14. CVE-2026-59311Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation6.8
  15. CVE-2026-59306Potential for deserialization of untrusted types in Spring Cloud Stream3.1

The record

Peak rank
#8 in Apr 2010
Busiest month shown
Aug 2026, 64 CVEs
Months with a KEV entry
18 since Oct 2018
Monthly snapshots
155 since 2000
VMware's full record, month by month