VMware security advisories, April 2026

Every VMware (Broadcom) security advisory published in April 2026, from VMware Security Advisories (VMSA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 26
Critical: 1
High: 8
In CISA KEV: 0
CVEs: 26

VMware advisories published in April 2026

Apr 29, 2026
Medium [CVE-2026-22745] Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.
Medium5.3
Apr 29, 2026
Medium [CVE-2026-22740] WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.
Medium6.5
Apr 29, 2026
Low [CVE-2026-22741] Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Low3.1
Apr 28, 2026
Critical [CVE-2026-40976] In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints
Critical9.1
Apr 28, 2026
High [CVE-2026-40978] SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries
High8.8
Apr 28, 2026
High [CVE-2026-40967] In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific…
High8.6
Apr 28, 2026
High [CVE-2026-40973] Spring Boot: local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`
High7.0
Apr 28, 2026
High [CVE-2026-40972] Spring Boot: attacker on the same network as the remote application
High7.5
Apr 28, 2026
Medium [CVE-2026-40968] When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker…
Medium4.2
Apr 28, 2026
Medium [CVE-2026-40980] In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory
Medium6.5
Apr 28, 2026
Medium [CVE-2026-40979] In Spring AI, having access to a shared environment can expose the ONNX model used by the application.
Medium6.1
Apr 28, 2026
Medium [CVE-2026-40966] In Spring AI, an attacker
Medium5.9
Apr 28, 2026
Medium [CVE-2026-40977] Spring Boot: When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location
Medium4.7
Apr 28, 2026
Medium [CVE-2026-40975] Spring Boot: Values produced by ${random.value} are not suitable for use as secrets.
Medium4.8
Apr 28, 2026
Medium [CVE-2026-40974] Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra
Medium5.0
Apr 28, 2026
Low [CVE-2026-40969] The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status…
Low3.7
Apr 27, 2026
Medium [CVE-2026-40971] When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification
Medium5.0
Apr 27, 2026
Medium [CVE-2026-40970] When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification
Medium5.0
Apr 22, 2026
High [CVE-2026-22754] ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
High7.5
Apr 22, 2026
High [CVE-2026-22753] Spring Security: Vulnerability in Spring Spring Security.
High7.5
Apr 22, 2026
Medium [CVE-2026-22748] Spring Security: Vulnerability in Spring Spring Security.
Medium5.3
Apr 22, 2026
Medium [CVE-2026-22747] Unauthorized User Impersonation when Using X.509 Client Certificates
Medium6.8
Apr 22, 2026
Low [CVE-2026-22746] Spring Security: Vulnerability in Spring Spring Security.
Low3.7
Apr 21, 2026
Medium [CVE-2026-22751] Spring Security: Vulnerability in Spring Spring Security.
Medium4.8
Apr 17, 2026
High [CVE-2026-22734] Cloud Foundry UUA is vulnerable to a bypass
High8.6
Apr 10, 2026
High [CVE-2026-22750] When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration…
High7.5

Get an email when VMware publishes the next one.

See VMware's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about VMware

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.