VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kapp-controller, vcluster, spqr, grafana, cass-operator, cluster-api-provider-vsphere, kube-rbac-proxy, kuma, yunikorn-k8shim, kubernetes-csi-external-attacher, datadog-operator, cert-manager-webhook-pdns, kwok, kubescape-operator, helm-operator, cloud-provider-azure...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, wait-for-port, kapp-controller, ini-file, amazon-cloudwatch-agent-operator, kubernetes-dashboard-api, flux, steampipe, nri-mysql, nodetaint, cluster-api-provider-vsphere, rabbitmq-default-user-credential-updater, terraform-mcp-server, kind, opa,...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...

EUVD-2026-53930

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

VMware vSphere Client (HTML5) - Remote Code Execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: net-kourier, multus-cni, kubernetes-dashboard-api, flux, promxy, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, croc, crossplane-provider-azure-sql, scorecard,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: net-kourier, timoni, pulumi-language-yaml, spqr, cloudnative-pg, grafana, amazon-cloudwatch-agent-operator, kubernetes-dashboard-api, rook, flux, argo-rollouts, mc, flannel, promxy, nerdctl, temporal, snyk-cli, flux-image-automation-controller,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, podman-fips, helm-exporter, cosign, gomplate, beats-fips, opa-envoy, pulumi, kyverno, prometheus-fips, external-secrets-operator-fips, cert-manager-fips, dgraph, helm-mapkubeapis, prometheus-elasticsearch-exporter, hubble, consul-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, podman-fips, helm-exporter, cosign, gomplate, beats-fips, opa-envoy, pulumi, kyverno, prometheus-fips, external-secrets-operator-fips, cert-manager-fips, dgraph, helm-mapkubeapis, prometheus-elasticsearch-exporter, hubble, consul-fips,...

PT-2026-28315

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 3.16.3 Foreman versions prior to 3.17.2 Foreman versions prior to 3.18.1 Description A flaw exists in Foreman that allows a remote attacker to exploit a command injection vulnerability within the WebSocket proxy...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, nfs-subdir-external-provisioner,...

CVE-2018-1000153

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...