VMware Tanzu Spring Framework

Name: VMware Tanzu Spring Framework
Brand: VMware Tanzu

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical3high6medium1low

updated 2026-10-28

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-38828US	—	0.72% (54th)	Exploit	5.3.42	2024-11-18	< 5.3.42
CVE-2024-38820US	medium5.3	0.62% (49th)	Exploit	6.1.14	2024-10-18	3 versions
CVE-2026-47884US	—	0.60% (49th)	Exploit	no fix	2026-08-27	7 versions
CVE-2025-41249US	—OT elevated	0.48% (41st)	Exploit	6.2.11	2025-09-16	< 6.2.11
CVE-2026-47883US	—	0.26% (18th)	Exploit	no fix	2026-08-27	7 versions
CVE-2023-34053US	high7.5	1.16% (67th)	—	6.0.14	2023-11-28	< 6.0.14
CVE-2024-38809US	—	0.85% (58th)	—	5.3.38	2024-09-27	3 versions
CVE-2024-38808US	—	0.57% (47th)	—	5.3.38	2024-08-20	2 versions
CVE-2026-59313US	—	0.56% (47th)	—	7.0.8.1	2026-08-27	6 versions
CVE-2026-47890US	—	0.56% (47th)	—	no fix	2026-08-27	7 versions
CVE-2026-59283US	—	0.55% (46th)	—	no fix	2026-08-27	7 versions
CVE-2026-47892US	—OT elevated	0.53% (45th)	—	no fix	2026-08-27	7 versions
CVE-2026-47891US	—	0.52% (44th)	—	no fix	2026-08-27	7 versions
CVE-2026-47893US	—	0.46% (40th)	—	no fix	2026-08-27	7 versions
CVE-2026-59282US	—	0.46% (40th)	—	no fix	2026-08-27	7 versions
CVE-2026-47888US	—	0.46% (40th)	—	no fix	2026-08-27	7 versions
CVE-2026-47886US	—	0.46% (40th)	—	no fix	2026-08-27	7 versions
CVE-2026-47889US	—	0.43% (37th)	—	no fix	2026-08-27	7 versions
CVE-2026-41843US	—	0.37% (31st)	—	7.0.8	2026-06-09	2 versions
CVE-2026-47885US	—	0.37% (30th)	—	no fix	2026-08-27	7 versions
CVE-2026-59280US	—	0.35% (28th)	—	no fix	2026-08-27	7 versions
CVE-2026-22740US	—	0.34% (28th)	—	6.1.27	2026-04-29	4 versions
CVE-2026-22745US	—	0.34% (27th)	—	6.2.18	2026-04-29	4 versions
CVE-2026-41841US	—	0.34% (27th)	—	6.2.19	2026-06-09	2 versions
CVE-2026-41848US	high7.5	0.34% (27th)	—	6.2.19	2026-06-09	2 versions
CVE-2025-41254US	—	0.31% (24th)	—	6.1.24	2025-10-16	3 versions
CVE-2026-41840US	—	0.27% (19th)	—	6.2.19	2026-06-09	2 versions
CVE-2026-41849US	—	0.26% (18th)	—	7.0.8	2026-06-09	2 versions
CVE-2026-59314US	low3.7	0.26% (17th)	—	no fix	2026-08-27	7 versions
CVE-2026-59281US	—	0.25% (17th)	—	no fix	2026-08-27	7 versions
CVE-2026-47887US	—	0.24% (15th)	—	no fix	2026-08-27	7 versions
CVE-2026-22741US	—	0.24% (14th)	—	7.0.7	2026-04-29	4 versions
CVE-2026-41839US	—	0.21% (11th)	—	6.2.19	2026-06-09	2 versions
CVE-2026-41852US	medium5.3OT elevated	0.18% (7th)	—	7.0.8	2026-06-09	2 versions
CVE-2026-41838US	high7.5OT elevated	0.17% (6th)	—	7.0.8	2026-06-09	2 versions
CVE-2026-41847US	medium5.3	0.17% (6th)	—	6.2.19	2026-06-09	2 versions
CVE-2026-41846US	medium6.1	0.15% (4th)	—	7.0.8	2026-06-09	2 versions
CVE-2026-41844US	medium6.1	0.14% (4th)	—	7.0.8	2026-06-09	2 versions
CVE-2026-41854US	medium6.5	0.12% (2nd)	—	7.0.8	2026-06-09	2 versions
CVE-2026-22735US	—	0.12% (2nd)	—	5.3.47	2026-03-20	4 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption8 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-404Improper Resource Shutdown or Release3 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')3 CVEs
CWE-770Allocation of Resources Without Limits or Throttling3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-1333Inefficient Regular Expression Complexity2 CVEs
CWE-284Improper Access Control2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)40 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan