VMware Tanzu Spring Security

Name: VMware Tanzu Spring Security
Brand: VMware Tanzu

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

unpatched

by severity

1critical2high6medium0low

updated 2026-10-28

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-38821US	—	1.74% (78th)	Exploit	6.3.4	2024-10-28	6 versions
CVE-2025-22223US	—	0.51% (43rd)	Exploit	6.1.14	2025-03-24	6 versions
CVE-2026-22747US	high8.1	0.24% (15th)	Exploit	7.0.5	2026-04-22	< 7.0.5
CVE-2025-41232US	—	0.62% (50th)	—	6.4.6	2025-05-21	< 6.4.6
CVE-2026-22752US	—	0.48% (41st)	—	7.0.5	2026-07-16	< 7.0.5
CVE-2025-41248US	—OT elevated	0.45% (39th)	—	6.5.4	2025-09-16	2 versions
CVE-2026-59270US	critical9.1OT elevated	0.40% (35th)	—	7.1.1	2026-08-27	2 versions
CVE-2026-41707US	—OT elevated	0.39% (33rd)	—	7.1.1	2026-08-25	2 versions
CVE-2025-22234US	—	0.39% (33rd)	—	5.7.17	2026-01-22	7 versions
CVE-2026-47841US	—OT elevated	0.36% (29th)	—	7.1.0.1	2026-08-26	2 versions
CVE-2026-59276US	—	0.33% (26th)	—	7.1.0.1	2026-08-27	2 versions
CVE-2026-40988US	—	0.33% (26th)	—	5.8.26	2026-06-10	6 versions
CVE-2026-59277US	medium5.3	0.29% (21st)	—	7.1.0.1	2026-08-27	2 versions
CVE-2026-47877US	medium6.1	0.28% (20th)	—	7.1.0.1	2026-08-27	2 versions
CVE-2026-22754US	—	0.27% (19th)	—	7.0.5	2026-04-22	< 7.0.5
CVE-2026-22753US	—	0.25% (16th)	—	7.0.5	2026-04-22	< 7.0.5
CVE-2023-34042US	medium5.5	0.24% (15th)	—	6.0.7	2024-02-05	4 versions
CVE-2026-22746US	—	0.21% (12th)	—	7.1.0-RC1	2026-04-22	3 versions
CVE-2026-41706US	—	0.21% (11th)	—	5.7.24	2026-06-10	6 versions
CVE-2026-41003US	medium5.4	0.20% (10th)	—	5.8.26	2026-06-10	6 versions
CVE-2026-22748US	medium6.5	0.20% (10th)	—	7.0.5	2026-04-22	2 versions
CVE-2026-40993US	high7.2	0.20% (9th)	—	7.0.6	2026-06-10	< 7.0.6
CVE-2026-41008US	—	0.18% (7th)	—	7.0.6	2026-06-10	< 7.0.6
CVE-2026-47842US	—	0.15% (4th)	—	7.1.0.1	2026-08-26	2 versions
CVE-2026-41694US	medium5.3	0.15% (4th)	—	7.0.6	2026-06-10	6 versions
CVE-2026-22751US	—	0.12% (2nd)	—	7.0.5	2026-04-21	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-693Protection Mechanism Failure4 CVEs
CWE-208Observable Timing Discrepancy3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-284Improper Access Control1 CVEs
CWE-285Improper Authorization1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan