Vendor
Vmware Tanzu
75 known vulnerabilities in products by Vmware Tanzu, 0 of them actively exploited (CISA KEV).
Key figures
75
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
14
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-5396 | JMX Insecure Default Configuration in GemFire | 8.8 | |
| Critical | CVE-2019-11286 | JMX Credential Deserialization in GemFire | 9.0 | |
| Critical | CVE-2026-47884 | Spring Framework Improper Path Limitation in XsltView | 9.8 | |
| Critical | CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web framework | 9.8 | |
| Critical | CVE-2026-47890 | Spring Framework Server Sent Event stream corruption while rendering fragments | 9.8 | |
| Critical | CVE-2025-41232 | Spring Security: security vulnerability | 9.1 | |
| Critical | CVE-2026-47892 | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints | 9.8 | |
| Critical | CVE-2026-47891 | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder | 9.8 | |
| Critical | CVE-2020-5415 | Concourse's GitLab auth allows impersonation | 10.0 | |
| Critical | CVE-2026-59283 | Spring Framework Safety Guard Bypass via SpEL Expression Compilation | 9.1 | |
| Medium | CVE-2023-20863 | Spring Framework: Uncontrolled Resource Consumption | 6.5 | |
| Critical | CVE-2026-22732 | Under Some Conditions Spring Security HTTP Headers Are not Written | 9.1 | |
| Critical | CVE-2026-22752 | Spring Authorization Server: Improper Authentication | 9.6 | |
| Critical | CVE-2026-59270 | Spring Security: security vulnerability | 9.4 | |
| Critical | CVE-2026-47837 | Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests | 6.8 | |
| High | CVE-2026-47893 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService | 7.5 | |
| High | CVE-2026-59282 | Spring Framework Denial of Service via Unbounded List Growth in Data Binding | 7.5 | |
| High | CVE-2026-47888 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler | 7.5 | |
| High | CVE-2026-47886 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions | 7.5 | |
| High | CVE-2026-47889 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse | 7.5 | |
| High | CVE-2026-41707 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay | 7.4 | |
| High | CVE-2026-47885 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader | 7.5 | |
| High | CVE-2026-47877 | Spring Security: Cross-Site Scripting (XSS) | 8.2 | |
| High | CVE-2026-47879 | Spring Cloud Gateway SSRF and native file access with gRPC | 7.7 | |
| Medium | CVE-2026-59284 | Spring Cloud Commons no allow list for writable env actuator endpoint | 6.6 |
News
Products
| Spring Security | 25 | 0 |
| Spring Framework Enterprise Support Only | 16 | 0 |
| Spring Framework Oss | 16 | 0 |
| Spring Cloud | 15 | 0 |
| Spring Boot | 4 | 0 |
| Spring Framework | 4 | 0 |