VMware

CPE vendor key: vmware · 204 CVEs published in the last 24 months.

CVEs (365 d)

183

▼ -74 vs prior 30d

Avg CVSS (365 d)

6.45

over 183 CVEs

Avg EPSS pct (365 d)

0.27

higher = more likely exploited

KEV hit rate (365 d)

1.1%

2 of 183 added to CISA KEV

LLM-credited CVEs

none detected

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

spring_framework

cloud_foundation

spring_ai

spring_security

telco_cloud_platform

spring_integration

aria_operations

telco_cloud_infrastructure

spring_boot

spring_cloud_config

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

Distinct CVEs assigned each weakness.

Known exploited, all time (40)

Published	CVE
2026-07-30	CVE-2026-59310
2026-02-25	CVE-2026-22719
2025-09-29	CVE-2025-41244
2025-03-04	CVE-2025-22224
2025-03-04	CVE-2025-22225
2025-03-04	CVE-2025-22226
2024-09-17	CVE-2024-38812
2024-09-17	CVE-2024-38813
2024-06-25	CVE-2024-37085
2024-06-18	CVE-2024-37079
2023-10-25	CVE-2023-34048
2023-06-13	CVE-2023-20867
2023-06-07	CVE-2023-20887
2023-04-25	CVE-2023-29552
2022-04-13	CVE-2022-22960
2022-04-11	CVE-2022-22954
2022-04-01	CVE-2022-22963
2022-04-01	CVE-2022-22965
2022-03-29	CVE-2022-22948
2022-03-03	CVE-2022-22947
2021-12-17	CVE-2021-22054
2021-09-23	CVE-2021-22005
2021-09-23	CVE-2021-22017
2021-05-26	CVE-2021-21985
2021-03-31	CVE-2021-21975
2021-02-24	CVE-2021-21972
2021-02-24	CVE-2021-21973
2020-11-23	CVE-2020-4006
2020-10-20	CVE-2020-3992
2020-06-02	CVE-2020-5410
2020-04-30	CVE-2020-11651
2020-04-30	CVE-2020-11652
2020-04-10	CVE-2020-3952
2020-03-17	CVE-2020-3950
2019-12-06	CVE-2019-5544
2018-06-11	CVE-2018-6961
2018-04-11	CVE-2018-1273
2014-09-25	CVE-2014-7169
2014-09-24	CVE-2014-6271
2010-12-06	CVE-2010-3904

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

Generated 16 October 2026 12:22 UTC .