VMware security advisories, May 2026

Every VMware (Broadcom) security advisory published in May 2026, from VMware Security Advisories (VMSA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 12
Critical: 1
High: 6
In CISA KEV: 0
CVEs: 12

VMware advisories published in May 2026

May 27, 2026
Medium [CVE-2026-41704] BOSH: AgentClient#handle_method (lines 264-303) processes every NATS reply.
Medium5.0
May 27, 2026
Medium [CVE-2026-41009] BOSH: When the director sends a long-running request (e.g.
Medium5.8
May 25, 2026
Medium [CVE-2026-41863] Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to…
Medium6.5
May 15, 2026
High [CVE-2026-41702] VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID…
High7.8
May 12, 2026
High [CVE-2026-41713] malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way
High8.2
May 12, 2026
High [CVE-2026-41712] Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could
High7.5
May 9, 2026
High [CVE-2026-41705] Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection
High8.6
May 7, 2026
Critical [CVE-2026-40982] Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module
Critical9.1
May 7, 2026
High [CVE-2026-41002] The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories…
High7.2
May 7, 2026
High [CVE-2026-40981] When using Google Secrets Manager as a backend for the Spring Cloud Config server a client
High7.5
May 7, 2026
Medium [CVE-2026-41004] Spring Cloud: When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Medium4.4
May 1, 2026
Medium [CVE-2026-22726] Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules.
Medium5.0

Get an email when VMware publishes the next one.

See VMware's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about VMware

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.