# Vmware Cloud Foundation


- [CVE-2024-38812](https://insights.sbomify.com/CVE-2024-38812/): VMware vCenter Server Heap-Based Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2024-37079](https://insights.sbomify.com/CVE-2024-37079/): Broadcom VMware vCenter Server Out-of-bounds Write (critical 9.8, exploited in the wild)
- [CVE-2022-22954](https://insights.sbomify.com/CVE-2022-22954/): VMware Workspace ONE Access and Identity Manager Server-Side Template Injection (critical 9.8, exploited in the wild)
- [CVE-2021-22005](https://insights.sbomify.com/CVE-2021-22005/): VMware vCenter Server File Upload (critical 9.8, exploited in the wild)
- [CVE-2021-21985](https://insights.sbomify.com/CVE-2021-21985/): VMware vCenter Server Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2021-21975](https://insights.sbomify.com/CVE-2021-21975/): VMware Server Side Request Forgery in vRealize Operations Manager API (critical 9.8, exploited in the wild)
- [CVE-2021-21972](https://insights.sbomify.com/CVE-2021-21972/): VMware vCenter Server Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-3992](https://insights.sbomify.com/CVE-2020-3992/): VMware ESXi OpenSLP Use-After-Free (critical 9.8, exploited in the wild)
- [CVE-2025-22224](https://insights.sbomify.com/CVE-2025-22224/): VMware ESXi and Workstation TOCTOU Race Condition (critical 9.3, exploited in the wild)
- [CVE-2020-4006](https://insights.sbomify.com/CVE-2020-4006/): Multiple VMware Products Command Injection (critical 9.1, exploited in the wild)
- [CVE-2025-22225](https://insights.sbomify.com/CVE-2025-22225/): VMware ESXi Arbitrary Write (high 8.2, exploited in the wild)
- [CVE-2026-22719](https://insights.sbomify.com/CVE-2026-22719/): Broadcom VMware Aria Operations Command Injection (high 8.1, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/products/vmware/cloud-foundation/