CVE-2026-51773

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

CVE-2026-51773: Server-Side Request Forgery (SSRF)

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

CVE-2026-51773

The VMware datastore driver of OpenStack glance_store contains a vulnerability where an authenticated attacker can provide a maliciously crafted image location URI. The _retry_request function fails to validate the destination host before attaching sensitive authentication headers, potentially le...

EUVD-2026-87084

An issue in the VMware datastore driver of OpenStack glancestore. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the retryrequest function fails to validate the destination host before attaching sensitive authentication headers...

DRUPAL-CONTRIB-2026-176

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials,...

Spring - Remote Code Execution

Spring MVC and Spring WebFlux applications running on Java Development Kit 9+ are susceptible to remote code execution via data binding. It requires the application to run on Tomcat as a WAR deployment. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full...

PT-2026-97667

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials,...

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials,...

The vulnerability of the locally deployed version of the orchestrator VeloCloud Orchestrator (VCO) on the On-Prem platform for managing programmatically configured VMware SD-WAN by VeloCloud allows a attacker to enhance their privileges and execute arbitrary code.

The vulnerability of the locally deployed version of the orchestrator VeloCloud Orchestrator VCO on the VMware SD-WAN by VeloCloud On-Prem platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

The vulnerability of the VMXNET3 network adapter allows attackers to escalate their privileges and execute arbitrary code on VMware Workstation and VMware Fusion hypervisors.

The vulnerability of the VMXNET3 network adapter in VMware Workstation and VMware Fusion relates to a potential overflow condition. Exploiting this vulnerability can allow an attacker to gain elevated privileges and execute arbitrary code...

drupal-penetration-testing-lab

Drupal Penetration Testing Lab A complete penetration testing...

VMware vCenter Server - Out-of-Bounds Write

vCenter Server contains an out-of-bounds write caused by a vulnerability in the DCERPC protocol implementation. A malicious actor with network access can trigger remote code execution on vCenter Server. id: CVE-2023-34048 info: name: VMware vCenter Server - Out-of-Bounds Write author: ritikchaddh...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

A Server-Side Request Forgery (SSRF) vulnerability exists in the VMware synchronization feature of Devolutions Server version 2026.2.16 and earlier . A low-privileged authenticated user can exploit this by submitting a crafted connection definition during datacenter discovery. This flaw allows th...

EUVD-2026-79181

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

PT-2026-92411

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description A Server-Side Request Forgery SSRF issue exists in the VMware synchronization feature. This allows a low-privileged authenticated user to reach internal or cloud-metadata network...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools 12.0.0, 11.x.y, and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the guest OS can escalate privileges as a root user in the virtual machine...