30
CVEs
7
Critical
10
High
0
KEV
0
PoC
16
Unpatched C/H
10.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
10
MEDIUM
12
LOW
0
Monthly CVE Trend
Affected Products (30)
Java
168
Cloud Foundation
126
Workstation
120
Fusion
104
ESXi
103
Vcenter Server
73
Spring Framework
56
Debian Linux
32
Spring Security
30
Identity Manager
28
Esx
28
Player
27
Workstation Pro
26
Workstation Player
25
Horizon Client
24
Vrealize Suite Lifecycle Manager
21
Tools
20
Vrealize Automation
19
Vrealize Operations
18
Telco Cloud Platform
16
Spring Boot
15
Workspace One Access
15
Identity Manager Connector
14
Fedora
14
Vcenter Server Appliance
14
Open Redirect
13
Aria Operations
13
Insurance Rules Palette
13
Horizon View
13
Healthcare Master Person Index
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-47892 | Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-59318 | Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request to be dispatched and invoked, which can escalate privileges when the out-of-boundary tool carries greater capabilities than the caller was granted. Affected are Spring AI 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0 (CPE cpe:2.3:a:vmware:spring_ai) in applications that actually use tool calling with a per-request tool list that restricts at least one tool relative to others, and where the attacker can influence the model's input; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (high attack complexity, unauthenticated) rather than the vendor's headline 9.8 AV:N/AC:L score, reflecting that exploitation is conditional ('under certain conditions') and not universally reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is low at 0.17% (7th percentile), and CISA SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total. Realized impact is bounded by the authority of whatever tool slips past the boundary. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47884 | Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47890 | Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47891 | Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-59270 | Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile). | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-47879 | Server-side request forgery (SSRF) in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory allows an authenticated gateway administrator to specify arbitrary Spring Resource URLs as the proto descriptor location, causing the gateway to fetch attacker-controlled internal or external resources. Affected versions span the 3.x through 5.x release trains (CPE: cpe:2.3:a:vmware:spring_cloud_gateway). A successful exploit enables the gateway host to be weaponized as an HTTP pivot into internal network services, with confidentiality and integrity impact on systems beyond the gateway boundary (S:C). No public exploit or active exploitation has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-41012 | Improper certificate validation in Cloud Foundry's bosh-vsphere-cpi-release exposes vCenter administrator credentials to any attacker with a network position between the BOSH Director and vCenter. The vSphere CPI transmits credentials via HTTP Basic authentication on every routine cloud infrastructure operation and fails to enforce TLS certificate authenticity, allowing a rogue endpoint to impersonate the vCenter REST API and silently capture those credentials. Successful interception yields full administrative control over every virtual machine, datastore, and network segment managed by the compromised vCenter instance. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. | HIGH | 7.7 | 0.1% | 39 |
|
| CVE-2026-47864 | Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments. | CRITICAL | 9.8 | 3.4% | 38 |
No patch
|
| CVE-2026-59279 | Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-47894 | Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-47885 | Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-47886 | Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-47888 | Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-47889 | WebFlux applications in Spring Framework running on the Jetty 12 Core reactive adapter omit the SameSite cookie attribute from serialized response cookies, exposing session and authentication cookies to cross-site request contexts. Affected versions span Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, covering a substantial footprint of reactive Java deployments on Jetty 12. The vulnerability carries a vendor CVSS of 7.5 with C:H reflecting potential session-token disclosure; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.14% (4th percentile). | HIGH | 7.5 | 0.1% | 38 |
No patch
|