VMWare ESXi

• CVE-2025-22224 Critical 9.3 Exploited VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machin 1.6%
• CVE-2025-41239 High 7.1 vSockets information-disclosure vulnerability 3.2%
• CVE-2025-41238 Critical 9.3 PVSCSI heap-overflow vulnerability 0.5%
• CVE-2025-41237 Critical 9.3 VMCI integer-underflow vulnerability 0.5%
• CVE-2025-41236 Critical 9.3 VMXNET3 integer-overflow vulnerability 2.6%
• CVE-2025-41228 Medium 4.3 VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability 0.9%
• CVE-2025-41227 Medium 5.5 Denial-of-Service Vulnerability 0.2%
• CVE-2025-41226 Medium 6.8 Guest Operations Denial-of-Service Vulnerability 0.2%
• CVE-2020-3955 Unrated ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluate 1.3%