VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: datadog-agent, cluster-api-azure-controller, zot, keda, cert-manager, kubernetes, kubernetes-csi-external-resizer, rancher-system-agent, tetragon, k3s, kapp-controller, fluent-operator, helm-operator, rke2-cloud-provider, flux-helm-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: falcoctl, cluster-api-azure-controller, docker-cli, oauth2-proxy, zot, kubeflow-katib, ip-masq-agent, k3d, nri-apache, rancher-system-agent, dgraph, harbor-cli, k3s, gobump, spire-controller-manager, steampipe, kapp-controller, helm-operator, gobuster, kpt, nova,...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

EUVD-2026-53930

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

VMware vSphere Client (HTML5) - Remote Code Execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: bank-vaults, neuvector-scanner, lvm-driver, kubeflow-katib, falco-exporter, keda, terraform-docs, docker-credential-ecr-login, kubernetes-csi-external-resizer, postgres-operator, sftpgo-plugin-auth, helm, otel-cli, kubernetes-csi-livenessprobe, argo-rollouts,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: bank-vaults, bento, smarter-device-manager, neuvector-scanner, timoni, datadog-agent, falcoctl, docker-cli, lvm-driver, ingress-nginx-controller, oauth2-proxy, karpenter, kubeflow-katib, slsa-verifier, falco-exporter, keda, splunk-otel-collector, zot, cert-manager,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: act, flux, helm-exporter-fips, flux-source-controller-fips, mattermost-fips, cloud-provider-aws, hubble, docker-cli-fips, datadog-agent, step-ca-fips, azuredisk-csi-fips, docker-cli-buildx, gosu, calico, licenseclassifier, tekton-pipelines, openbao, falcoctl,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: act, flux, helm-exporter-fips, flux-source-controller-fips, mattermost-fips, cloud-provider-aws, hubble, docker-cli-fips, datadog-agent, step-ca-fips, azuredisk-csi-fips, docker-cli-buildx, gosu, calico, licenseclassifier, tekton-pipelines, openbao, falcoctl,...

PT-2026-28315

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 3.16.3 Foreman versions prior to 3.17.2 Foreman versions prior to 3.18.1 Description A flaw exists in Foreman that allows a remote attacker to exploit a command injection vulnerability within the WebSocket proxy...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: hydra, kubecolor, calico-fips, flux, kafka-proxy, nri-redis-fips, kubernetes-csi-external-resizer, k3d, tailscale, mattermost-fips, prometheus-postgres-exporter, cloud-provider-aws, crossplane-provider-family-aws, hubble, amazon-cloudwatch-agent-operator,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: hydra, kubecolor, calico-fips, flux, kafka-proxy, nri-redis-fips, kubernetes-csi-external-resizer, k3d, tailscale, mattermost-fips, prometheus-postgres-exporter, cloud-provider-aws, crossplane-provider-family-aws, hubble, amazon-cloudwatch-agent-operator,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: hydra, calico-fips, flux, kafka-proxy, nri-redis-fips, kubernetes-csi-external-resizer, k3d, tailscale, mattermost-fips, prometheus-postgres-exporter, cloud-provider-aws, crossplane-provider-family-aws, hubble, amazon-cloudwatch-agent-operator, spiffe-helper, rekor,...

CVE-2018-1000153

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...