757 matches found
VMware vSphere - Server-Side Request Forgery
VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kots, cloud-provider-azure, datadog-operator, spicedb, metallb, cass-operator, spqr, emissary, kubescape, argocd-image-updater, cluster-api, datadog-agent, rke2-cloud-provider, metrics-server, cluster-api-aws-controller, k8ssandra-client, cilium, helm-operator,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: thanos-operator, bom, ip-masq-agent, nri-f5, kind, emissary, nri-apache, spire-controller-manager, kubernetes-dashboard, aws-otel-collector, oauth2-proxy, migrate, kubernetes-csi-driver-hostpath, kubernetes-dashboard-api, aws-application-networking-k8s, eksctl,...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-54489
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...
CVE-2026-54489
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...
CVE-2026-54489
Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...
EUVD-2026-53930
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
VMware vSphere Client (HTML5) - Remote Code Execution
The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: kots, wave, cloud-provider-azure, harbor, mailpit, ip-masq-agent, neuvector-scanner, rancher-helm, dfc, pulumi, nri-mongodb, otel-cli, mattermost, gitsign, kubernetes-dashboard, pguser, xeol, node-problem-detector, nri-postgresql, juicefs-csi-driver, spegel,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: kots, wave, cloud-provider-azure, harbor, bom, ingress-nginx-controller, prometheus-operator, mc, net-kourier, litestream, aws-efs-csi-driver, crossplane-provider-family-azure, neuvector-scanner, rancher-helm, spiffe-helper, x509-certificate-exporter, filebrowser,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...
PT-2026-28315
Name of the Vulnerable Software and Affected Versions Foreman versions prior to 3.16.3 Foreman versions prior to 3.17.2 Foreman versions prior to 3.18.1 Description A flaw exists in Foreman that allows a remote attacker to exploit a command injection vulnerability within the WebSocket proxy...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, pulumi-kubernetes-operator, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui,...
CVE-2018-1000153
A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...