CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:40 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product vmware:vcenter_server. Show all products

13 CVEs, showing 1 to 13

CVE	Severity	Title	Published
CVE-2020-3952 Known exploited	Critical 9.8	Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls. Assigned by vmware	Apr 10, 2020
CVE-2021-21973 Known exploited	Medium 5.3	The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. Assigned by vmware	Feb 24, 2021
CVE-2021-21972 Known exploited	Critical 9.8	The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Assigned by vmware	Feb 24, 2021
CVE-2021-21985 Known exploited	Critical 9.8	The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. Assigned by vmware	May 26, 2021
CVE-2021-22005 Known exploited	Critical 9.8	The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Assigned by vmware	Sep 23, 2021
CVE-2021-22017 Known exploited	Medium 5.3	Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. Assigned by vmware	Sep 23, 2021
CVE-2022-22948 Known exploited	Medium 6.5	The vCenter Server contains an information disclosure vulnerability due to improper permission of files. Assigned by vmware	Mar 29, 2022
CVE-2023-34048 Known exploited	Critical 9.8	VMware vCenter Server Out-of-Bounds Write Vulnerability Assigned by vmware	Oct 25, 2023
CVE-2024-37079 Known exploited	Critical 9.8	vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. Assigned by vmware	Jun 18, 2024
CVE-2024-38812 Known exploited	Critical 9.8	Heap-overflow vulnerability Assigned by vmware	Sep 17, 2024
CVE-2024-38813 Known exploited	High 7.5	Privilege escalation vulnerability Assigned by vmware	Sep 17, 2024
CVE-2026-59310 Known exploited	Critical 9.8	vCenter directory-traversal vulnerability Assigned by vmware	Jul 30, 2026
CVE-2026-59309	Critical 9.8	VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.	Jul 30, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.