VMware Tanzu Spring Cloud

Name: VMware Tanzu Spring Cloud
Brand: VMware Tanzu

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical6high5medium8low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-41243US	—	3.67% (90th)	Exploit	2025.0.1	2025-09-16	5 versions
CVE-2026-40982US	—	0.73% (54th)	Exploit	no fix	2026-05-07	5 versions
CVE-2022-31197US	high8.0	2.35% (84th)	—	Dataflow 2.9.6	2022-08-03	< Dataflow 2.9.6
CVE-2026-22739US	—	1.22% (69th)	—	no fix	2026-03-24	5 versions
CVE-2023-6378US	high7.5	0.90% (59th)	—	no fix	2023-11-29	≤ Dataflow <2.11.2
CVE-2026-47837US	critical9.8OT elevated	0.55% (46th)	—	2025.1.3	2026-08-26	< 2025.1.3
CVE-2026-47894US	high7.5	0.49% (42nd)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-40981US	—	0.43% (38th)	—	no fix	2026-05-07	5 versions
CVE-2026-59284US	—	0.43% (37th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59315US	—	0.40% (34th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2025-41235US	—	0.36% (29th)	—	no fix	2025-05-30	5 versions
CVE-2026-47879US	high8.7	0.33% (26th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2025-22232US	—	0.32% (24th)	—	no fix	2025-04-10	5 versions
CVE-2026-41708US	—	0.28% (20th)	—	no fix	2026-06-15	≤ Sleuth <3.1.14
CVE-2026-59291US	medium5.5	0.24% (16th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59302US	medium4.9	0.23% (14th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59301US	medium4.9	0.23% (14th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59306US	low3.8	0.23% (13th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59298US	low3.5	0.22% (13th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-41002US	high8.1	0.22% (12th)	—	no fix	2026-05-07	5 versions
CVE-2026-22750US	—	0.22% (12th)	—	no fix	2026-04-10	≤ Gateway <4.2.1
CVE-2026-47836US	high8.1	0.22% (12th)	—	2025.1.3	2026-08-26	< 2025.1.3
CVE-2026-40990US	medium6.5	0.21% (11th)	—	no fix	2026-06-01	4 versions
CVE-2026-40989US	medium6.5	0.21% (11th)	—	no fix	2026-06-01	4 versions
CVE-2026-59305US	low3.8	0.21% (11th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59304US	low3.8	0.21% (11th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59303US	low3.8	0.21% (11th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59300US	low3.5	0.21% (11th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-59299US	low3.5	0.21% (11th)	—	2025.1.3	2026-08-27	< 2025.1.3
CVE-2026-47825US	—	0.18% (7th)	—	no fix	2026-06-15	6 versions
CVE-2026-41004US	—	0.17% (6th)	—	no fix	2026-05-07	5 versions
CVE-2026-59297US	low3.5	0.13% (3rd)	—	2025.1.3	2026-08-27	< 2025.1.3

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-532Insertion of Sensitive Information into Log File4 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-346Origin Validation Error2 CVEs
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan