VMware security advisories, August 2026

Every VMware (Broadcom) security advisory published in August 2026, from VMware Security Advisories (VMSA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 49
Critical: 8
High: 14
In CISA KEV: 0
CVEs: 49

VMware advisories published in August 2026

Aug 29, 2026
High [CVE-2026-41012] BOSH: Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and…
High7.7
Aug 27, 2026
Critical [CVE-2026-59313] Spring Framework: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
Critical9.8
Aug 27, 2026
Critical [CVE-2026-59283] Spring Framework: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnera…
Critical9.1
Aug 27, 2026
Critical [CVE-2026-59354] Spring Security: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registra…
Critical9.6
Aug 27, 2026
Critical [CVE-2026-47892] Spring Framework: WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header pr…
Critical9.8
Aug 27, 2026
Critical [CVE-2026-47891] Spring Framework: Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the…
Critical9.8
Aug 27, 2026
Critical [CVE-2026-47890] Spring Framework: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view…
Critical9.8
Aug 27, 2026
Critical [CVE-2026-47884] Spring Framework: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping…
Critical9.8
Aug 27, 2026
Critical [CVE-2026-59270] Spring Security: Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative cre…
Critical9.4
Aug 27, 2026
High [CVE-2026-59284] Spring Cloud: There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.
High7.6
Aug 27, 2026
High [CVE-2026-59282] Spring Framework: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths ont…
High7.5
Aug 27, 2026
High [CVE-2026-47893] Spring Framework: Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by…
High7.5
Aug 27, 2026
High [CVE-2026-47889] Spring Framework: WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite…
High7.5
Aug 27, 2026
High [CVE-2026-47888] Spring Framework: Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
High7.5
Aug 27, 2026
High [CVE-2026-47886] Spring Framework: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial…
High7.5
Aug 27, 2026
High [CVE-2026-47885] Spring Framework: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set t…
High7.5
Aug 27, 2026
High [CVE-2026-47879] Spring Cloud: Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto…
High7.7
Aug 27, 2026
High [CVE-2026-47877] Spring Security: Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
High8.2
Aug 27, 2026
Medium [CVE-2026-59315] Spring Cloud: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads.
Medium5.3
Aug 27, 2026
Medium [CVE-2026-59281] Spring Framework: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then re…
Medium6.1
Aug 27, 2026
Medium [CVE-2026-59276] Spring Security: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals…
Medium5.9
Aug 27, 2026
Medium [CVE-2026-59272] RabbitMQ: Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exp…
Medium6.8
Aug 27, 2026
Medium [CVE-2026-59280] Spring Framework: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a cont…
Medium4.3
Aug 27, 2026
Medium [CVE-2026-59355] Spring Authorization Server: Open Redirect via request_uri parameter
Medium6.1
Aug 27, 2026
Medium [CVE-2026-59271] RabbitMQ: When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thr…
Medium5.3
Aug 27, 2026
Medium [CVE-2026-47887] Spring Framework: Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a…
Medium6.1
Aug 27, 2026
Medium [CVE-2026-47883] Spring Framework: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns.
Medium6.1
Aug 27, 2026
Medium [CVE-2026-47894] Spring Cloud: Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the config…
Medium4.9
Aug 27, 2026
Low [CVE-2026-59314] Spring Framework: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response sp…
Low3.7
Aug 27, 2026
Low [CVE-2026-59306] Spring Cloud: Potential for deserialization of untrusted types in Spring Cloud Stream.
Low3.1
Aug 27, 2026
Low [CVE-2026-59305] Spring Cloud: Partition interceptor may be improperly added while sending message.
Low3.1
Aug 27, 2026
Low [CVE-2026-59304] Spring Cloud: Improper caching of the original content type in Spring Cloud Stream Avro.
Low3.1
Aug 27, 2026
Low [CVE-2026-59303] Spring Cloud: Dynamic destination cache size is not properly bound in Spring Cloud Stream.
Low3.1
Aug 27, 2026
Low [CVE-2026-59302] Spring Cloud: Potential for logging sensitive data in Spring Cloud Stream.
Low3.1
Aug 27, 2026
Low [CVE-2026-59301] Spring Cloud: Potential for logging sensitive data in Spring Cloud Function Azure.
Low3.1
Aug 27, 2026
Low [CVE-2026-59300] Spring Cloud: Potential for logging sensitive data in Spring Cloud Function AWS.
Low3.1
Aug 27, 2026
Low [CVE-2026-59299] Spring Cloud: Composition lookup can potentially poison base function in Spring Cloud Function.
Low3.1
Aug 27, 2026
Low [CVE-2026-59298] Spring Cloud: Potential for improper filtering of HTTP headers in Spring Cloud Function.
Low3.1
Aug 27, 2026
Low [CVE-2026-59297] Spring Cloud: Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme.
Low3.1
Aug 27, 2026
Low [CVE-2026-59291] Spring Cloud: Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.
Low2.0
Aug 27, 2026
Low [CVE-2026-59277] Spring Security: Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing…
Low3.7
Aug 26, 2026
High [CVE-2026-47841] Spring Security: application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a di…
High7.4
Aug 26, 2026
High [CVE-2026-47836] Spring Cloud: The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repos…
High7.2
Aug 26, 2026
Medium [CVE-2026-47842] Spring Security: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as…
Medium6.5
Aug 26, 2026
Medium [CVE-2026-47837] Spring Cloud: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to S…
Medium6.8
Aug 25, 2026
High [CVE-2026-41707] Spring Security: Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwt…
High7.4
Aug 21, 2026
High [CVE-2026-47827] BOSH: Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell co…
High7.5
Aug 21, 2026
Medium [CVE-2026-59323] Spring Boot: application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of s…
Medium5.3
Aug 6, 2026
Medium [CVE-2026-41861] BOSH: Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file wi…
Medium4.2

Get an email when VMware publishes the next one.

See VMware's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about VMware

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.