CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
VMware has 811 CVEs, 30 exploited. Pick a weakness or a product to list them.
By weakness
- Memory Corruption155 · 6 exploited
- Access Control104 · 5 exploited
- Cross-site Scripting52
- File and Path Handling50 · 3 exploited
- Authentication49 · 3 exploited
- Information Disclosure45
- Denial of Service44
- Command and Code Injection35 · 8 exploited
- Input Validation and Logic29
- Injection and Smuggling19
- Cryptography17
- Deserialization and Object Injection17
- Race Conditions13 · 1 exploited
- Server-Side Request Forgery10 · 2 exploited
- Cross-Site Request Forgery9
- Misconfiguration and Insecure Design7
- SQL Injection7
- Open Redirect5
- Other weaknesses3 · 1 exploited
- Insecure Direct Object Reference2
- No weakness recorded139 · 1 exploited
By product
- Workstation68
- Ace41
- ESXi31 · 2 exploited
- Esx28
- VMware ESXi26 · 3 exploited
- Vcenter Server24
- Spring Framework21 · 1 exploited
- VMware vCenter Server, VMware Cloud Foundation19 · 2 exploited
- VMware Workspace ONE Access, Identity Manager and vRealize Automation16 · 1 exploited
- VMware vCenter Server15 · 6 exploited
- VMware Workstation15
- VMware Aria Operations14 · 1 exploited
- Fusion13
- Player13
- VMware vRealize Operations13 · 1 exploited
- SALT11
- Spring Security10
- Avi Load Balancer8
- Cloud Foundation8 · 2 exploited
- Vcenter Server Appliance8
- Workstation Pro/Player8
- Tools7
- VMware Tools7 · 1 exploited
- VMware vRealize Log Insight7
- Workstation Player7
- Virtualcenter6
- VMware Aria Operations for Logs6
- VMware SD-WAN Orchestrator6
- VMware vCenter Server and VMware Cloud Foundation6 · 2 exploited
- VMware Workstation and Horizon Client for Windows6
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.