VMware security advisories, June 2026

Every VMware (Broadcom) security advisory published in June 2026, from VMware Security Advisories (VMSA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 85
Critical: 3
High: 39
In CISA KEV: 0
CVEs: 85

VMware advisories published in June 2026

Jun 23, 2026
High [CVE-2026-41862] Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine…
High8.8
Jun 18, 2026
Critical [CVE-2026-47846] Bitnami Cassandra container images are affected by a retained default superuser vulnerability.
Critical9.8
Jun 18, 2026
Medium [CVE-2026-47847] Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the…
Medium5.3
Jun 18, 2026
Medium [CVE-2026-47833] setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow.
Medium6.1
Jun 15, 2026
High [CVE-2026-47825] Spring Cloud: Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain conf…
High8.6
Jun 15, 2026
High [CVE-2026-47835] In Spring AI Vector Stores, special characters
High8.6
Jun 15, 2026
High [CVE-2026-41708] Spring Cloud: In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-servi…
High7.5
Jun 11, 2026
Critical [CVE-2026-41005] Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML…
Critical9.0
Jun 11, 2026
High [CVE-2026-41856] The Spring GraphQL annotation detection mechanism for @Controller data fetchers
High7.5
Jun 11, 2026
High [CVE-2026-41700] Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking
High8.1
Jun 11, 2026
High [CVE-2026-41699] Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
High8.1
Jun 11, 2026
High [CVE-2026-40999] When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS
High8.6
Jun 11, 2026
High [CVE-2026-40998] Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed…
High8.2
Jun 11, 2026
High [CVE-2026-40994] Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled…
High8.2
Jun 11, 2026
High [CVE-2026-40987] malicious or compromised FTP/SFTP/SMB server
High7.1
Jun 11, 2026
Medium [CVE-2026-41001] Spring Boot: Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…
Medium5.3
Jun 11, 2026
Medium [CVE-2026-40997] Spring Security: Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or…
Medium5.3
Jun 11, 2026
Medium [CVE-2026-40996] Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for…
Medium4.8
Jun 11, 2026
Medium [CVE-2026-40995] Spring Security: X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate map…
Medium5.4
Jun 11, 2026
Medium [CVE-2026-40992] Spring Boot: Spring Boot's Mail auto-configuration does not enable hostname verification.
Medium5.0
Jun 11, 2026
Medium [CVE-2026-40986] Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even
Medium4.8
Jun 11, 2026
Medium [CVE-2026-40985] Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.
Medium6.4
Jun 11, 2026
Low [CVE-2026-41000] Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks
Low3.7
Jun 10, 2026
High [CVE-2026-41732] JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package…
High8.1
Jun 10, 2026
High [CVE-2026-41731] JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix…
High8.1
Jun 10, 2026
High [CVE-2026-41729] Spring Data REST is vulnerable to SpEL expression injection through map-typed properties
High8.1
Jun 10, 2026
High [CVE-2026-41728] Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to…
High7.5
Jun 10, 2026
High [CVE-2026-41717] Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability.
High8.1
Jun 10, 2026
High [CVE-2026-41716] Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing…
High7.5
Jun 10, 2026
High [CVE-2026-41695] Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion
High7.5
Jun 10, 2026
High [CVE-2026-41003] Spring Security: attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms gene…
High7.6
Jun 10, 2026
High [CVE-2026-40993] Spring Security: attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asser…
High7.3
Jun 10, 2026
High [CVE-2026-40988] Spring Security: application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may…
High7.5
Jun 10, 2026
Medium [CVE-2026-47838] Spring Security: SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can le…
Medium6.8
Jun 10, 2026
Medium [CVE-2026-41837] Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does…
Medium5.3
Jun 10, 2026
Medium [CVE-2026-41730] Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing…
Medium5.3
Jun 10, 2026
Medium [CVE-2026-41727] Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them
Medium6.5
Jun 10, 2026
Medium [CVE-2026-41726] When an application opts into DelegatingDeserializer, a producer
Medium6.5
Jun 10, 2026
Medium [CVE-2026-41721] Spring Data Commons contains a vulnerability that can
Medium5.9
Jun 10, 2026
Medium [CVE-2026-41719] SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository…
Medium6.4
Jun 10, 2026
Medium [CVE-2026-41714] Applications that configure their broker connection
Medium4.0
Jun 10, 2026
Medium [CVE-2026-41711] Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException
Medium5.9
Jun 10, 2026
Medium [CVE-2026-41706] Spring Security: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a brows…
Medium6.1
Jun 10, 2026
Medium [CVE-2026-41701] Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable
Medium4.4
Jun 10, 2026
Medium [CVE-2026-41697] Spring Data Relational does not properly escape binding values of externally-controlled input
Medium4.8
Jun 10, 2026
Medium [CVE-2026-41696] Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient…
Medium5.9
Jun 10, 2026
Medium [CVE-2026-41008] Spring Security: Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri par…
Medium6.1
Jun 10, 2026
Medium [CVE-2026-40991] When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker…
Medium5.9
Jun 10, 2026
Low [CVE-2026-41694] Spring Security: Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses wit…
Low3.7
Jun 9, 2026
High [CVE-2026-41855] Spring Framework: In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.sp…
High8.1
Jun 9, 2026
High [CVE-2026-41850] Spring Framework: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial…
High7.5
Jun 9, 2026
High [CVE-2026-41849] Spring Framework: integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL).
High7.5
Jun 9, 2026
High [CVE-2026-41845] Spring Framework: Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape may
High7.1
Jun 9, 2026
High [CVE-2026-41842] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.
High7.5
Jun 9, 2026
High [CVE-2026-41720] Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired…
High7.4
Jun 9, 2026
High [CVE-2026-41007] Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
High7.5
Jun 9, 2026
High [CVE-2026-41006] Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type…
High7.5
Jun 9, 2026
High [CVE-2026-40984] Micrometer HTTP server instrumentations DoS vulnerability
High7.5
Jun 9, 2026
High [CVE-2026-40983] In Micrometer, it is possible for a user to provide specially crafted gRPC requests
High7.5
Jun 9, 2026
Medium [CVE-2026-41854] Spring Framework: Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally pro…
Medium4.2
Jun 9, 2026
Medium [CVE-2026-41853] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Medium5.3
Jun 9, 2026
Medium [CVE-2026-41851] Spring Framework: Applications which accept user-supplied Spring Expression Language (SpEL) expressions
Medium5.3
Jun 9, 2026
Medium [CVE-2026-41847] Spring Framework: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Medium4.8
Jun 9, 2026
Medium [CVE-2026-41846] Spring Framework: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags
Medium5.9
Jun 9, 2026
Medium [CVE-2026-41844] Spring Framework: Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified
Medium4.2
Jun 9, 2026
Medium [CVE-2026-41843] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Medium5.9
Jun 9, 2026
Medium [CVE-2026-41841] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Medium5.9
Jun 9, 2026
Medium [CVE-2026-41840] Spring Framework: Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Medium5.9
Jun 9, 2026
Medium [CVE-2026-41839] Spring Framework: WebFlux application with a compromised subdomain (for example, compromised
Medium4.2
Jun 9, 2026
Medium [CVE-2026-41838] Spring Framework: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which
Medium4.8
Jun 9, 2026
Medium [CVE-2026-41715] In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client
Medium6.1
Jun 9, 2026
Medium [CVE-2026-41710] attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide…
Medium5.9
Jun 9, 2026
Low [CVE-2026-41852] Spring Framework: vulnerability in Spring Expression Language (SpEL) evaluation logic
Low3.7
Jun 9, 2026
Low [CVE-2026-41848] Spring Framework: Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a…
Low3.7
Jun 8, 2026
High [CVE-2026-41724] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with…
High8.0
Jun 4, 2026
High [CVE-2026-41010] BOSH: ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs'…
High8.2
Jun 4, 2026
High [CVE-2026-41860] BOSH: CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM.
High8.8
Jun 4, 2026
High [CVE-2026-41859] network man-in-the-middle between nats-sync and the BOSH director
High7.8
Jun 4, 2026
High [CVE-2026-41858] Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release
High7.5
Jun 4, 2026
High [CVE-2026-41011] BOSH: PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and…
High8.2
Jun 1, 2026
Critical [CVE-2026-40965] Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure.
Critical10.0
Jun 1, 2026
High [CVE-2026-40964] Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations
High7.5
Jun 1, 2026
High [CVE-2026-41013] Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release
High8.1
Jun 1, 2026
Medium [CVE-2026-40990] Spring Cloud: OOM error is possible while attempting to add infinite amount of functions to Function Registry.
Medium5.7
Jun 1, 2026
Medium [CVE-2026-40989] Spring Cloud: Under infinite recursion in the routing layer, request-handling can cause OOM error.
Medium5.7

Get an email when VMware publishes the next one.

See VMware's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about VMware

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.