CF
Product
Cloud Foundation
On CISA KEVExploited in the wildRansomware-linked
141
CVEs
21
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 21High 66Medium 50Low 4
Watch
Add Cloud Foundation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-31681 | 6.5 | Oct 7 | VMware ESXi contains a null-pointer deference vulnerability Affected: 4.2 before 4.3.1.1; 4.4; 4.4.1; 4.4.1.1 |
| CVE-2021-22018 | 6.5 | Sep 23 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in Affected: 4.0 before 4.3.1 |
| CVE-2021-21993 | 6.5 | Sep 23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library Affected: 3.0 before 5.0 |
| CVE-2021-21992 | 6.5 | Sep 22 | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing Affected: 3.0 before 3.10.2.2; 4.0 before 4.3 |
| CVE-2021-21983 | 6.5 | Mar 31 | Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize… Affected: 3.0; 3.0.1; 3.0.1.1; 3.5; 3.5.1; 3.7; +9 more |
| CVE-2024-38832 | 6.4 | Nov 26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to… Affected: 4.0 through 5.2 |
| CVE-2023-20884 | 6.1 | May 30 | VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an… Affected: All versions, or not specified |
| CVE-2021-22016 | 6.1 | Sep 23 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization Affected: 3.0 before 5.0 |
| CVE-2025-22245 | 5.9 | Jun 4 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation Affected: 4.5 through 5.2.1.2 |
| CVE-2020-3993 | 5.9 | Oct 20 | VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX… Affected: 3.0 before 3.10.1.1; 4.0 before 4.1 |
| CVE-2020-3981 | 5.8 | Oct 20 | VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an… Affected: 3.0 before 3.10.1; 4.0 before 4.1 |
| CVE-2022-31697 | 5.5 | Dec 13 | The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext Affected: 3.0 and later |
| CVE-2021-22020 | 5.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in the Analytics service Affected: 3.0 before 3.10.2.2; 4.0 before 4.3 |
| CVE-2021-22007 | 5.5 | Sep 23 | The vCenter Server contains a local information disclosure vulnerability in the Analytics service Affected: 3.0 before 5.0 |
| CVE-2020-3971 | 5.5 | Jun 25 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before 11.0.2) contain a heap overflow… Affected: 3.0 before 3.7.2 |
| CVE-2020-3965 | 5.5 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 3.0 before 3.10; 4.0.0 before 4.0.1 |
| CVE-2020-3963 | 5.5 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 3.0 before 3.10; 4.0.0 before 4.0.1 |
| CVE-2026-41724 | 5.4 | Jun 8 | VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) Affected: 5.0 before 8.18.7 |
| CVE-2026-41722 | 5.4 | Jun 8 | VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) Affected: 5.0 before 8.18.7; 9.0 before 9.0.2.0; 9.1 |
| CVE-2025-22220 | 5.4 | Jan 30 | VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs… Affected: 4.0 through 5.2 |
| CVE-2024-38833 | 5.4 | Nov 26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to… Affected: 4.0 through 5.2 |
| CVE-2021-22021 | 5.4 | Aug 30 | VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation Affected: 4.0 before 4.3 |
| CVE-2024-37087 | 5.3 | Jun 25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition Affected: 4.0 before 5.2 |
| CVE-2022-31701 | 5.3 | Dec 14 | VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability Affected: All versions, or not specified |
| CVE-2022-31698 | 5.3 | Dec 13 | The vCenter Server contains a denial-of-service vulnerability in the content library service Affected: 3.0; 3.0.1; 3.0.1.1; 3.5; 3.5.1; 3.7; +25 more |
| CVE-2022-22961 | 5.3 | Apr 13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information Affected: 3.0 before 5.0 |
| CVE-2021-22011 | 5.3 | Sep 23 | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library Affected: 3.0 before 5.0 |
| CVE-2020-3995 | 5.3 | Oct 20 | In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by… Affected: 3.0 before 3.9 |
| CVE-2020-3976 | 5.3 | Aug 21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services Affected: 3.0 before 3.10; 4.0 before 4.0.1 |
| CVE-2024-22275 | 4.9 | May 21 | The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially… Affected: 4.0 before 5.1.1 |
| CVE-2022-22939 | 4.9 | Feb 4 | VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager Affected: 3.0 through 3.10.2.2; 4.0 through 4.1.0.1 |
| CVE-2021-22022 | 4.9 | Aug 30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability Affected: 3.0 through 3.10.2.1; 4.0 through 4.2.1 |
| CVE-2025-22221 | 4.8 | Jan 30 | VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to… Affected: 4.0 through 5.2 |
| CVE-2024-38834 | 4.8 | Nov 26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script… Affected: 4.0 through 5.2 |
| CVE-2020-3964 | 4.7 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 3.0 before 3.10; 4.0.0 before 4.0.1 |
| CVE-2022-22959 | 4.3 | Apr 13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability Affected: 3.0 before 5.0 |
| CVE-2021-22035 | 4.3 | Oct 13 | VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function Affected: 4.0.0 through 4.3.1 |
| CVE-2020-3970 | 3.8 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before… Affected: 3.0 before 3.10; 4.0.0 before 4.0.1 |
| CVE-2022-31699 | 3.3 | Dec 13 | VMware ESXi contains a heap-overflow vulnerability Affected: 3.0; 3.0.1; 3.0.1.1; 3.5; 3.5.1; 3.7; +24 more |
| CVE-2026-41709 | 2.7 | Jul 30 | ESX insufficient logging vulnerability Affected: 9.1.x.x; 9.0.x.x; 5.x before 5.2.4 |
| CVE-2021-22033 | 2.7 | Oct 13 | Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability Affected: 3.0.0 through 4.3.1 |