Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation VulnerabilityEPSS 0.3%Sep 9, 2026
- Critical9.8In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched.Aug 21, 2026
- UnknownCritical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)EPSS 0.6%Jul 30, 2026
- Critical9.8Broadcom VMware vCenter Path Traversal VulnerabilityKEVEPSS 2.6%Jul 30, 2026
- Medium6.5Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk.May 25, 2026
- High7.0VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary.May 15, 2026
- High7.2An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM…EPSS 0.1%May 13, 2026
- High8.8A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.EPSS 0.1%May 13, 2026
- High8.8A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.EPSS 0.1%May 13, 2026
- High8.3Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service.EPSS 0.1%May 12, 2026
- Critical9.3Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow an escalation of privilege.EPSS 0.1%May 12, 2026
- High8.3Out-of-bounds read for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service.EPSS 0.1%May 12, 2026
- High8.2A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way.May 12, 2026
- High7.5Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.May 12, 2026
- High8.6Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.May 9, 2026
- Medium4.4When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.May 7, 2026
- High8.1The base directory ( ) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.May 7, 2026
- Critical9.1Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.May 7, 2026
- High7.5When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from u…May 7, 2026
- Medium5.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.EPSS 0.3%Apr 29, 2026
- Low3.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.EPSS 0.2%Apr 29, 2026
- Medium6.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.EPSS 0.3%Apr 29, 2026
- Medium5.3The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description.Apr 28, 2026
- High8.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent…Apr 28, 2026
- Medium6.5In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by .Apr 28, 2026
97 records · page 1 of 4
PreviousNext