CVE-2026-41723

HighCVSS 8.0/10Last modified Jul 23, 2026

Description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
VMware	VCF operations	>= 9.1.x.x, <= 9.1.0.0; >= 9.0.x.x, <= 9.0.2.0 EP2; >= 5.x, <= 8.18.7
VMware	VMware Aria Operations	>= 8.18.x, <= 8.18.6; >= 8.18.x, <= 8.18.7
VMware	VMware Telco Cloud Platform	>= 5.x, <= 8.18.7

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513Third Party Advisory

Timeline

Published: Jun 8, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-417245.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417266.5When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique r CVE-2026-417276.5Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer coul CVE-2026-417287.5Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segme CVE-2026-417298.1Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+CVE-2026-41736.3A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/expor CVE-2026-417305.3Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals CVE-2026-417318.1JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meanin CVE-2026-417328.1JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trus CVE-2026-41743.3A vulnerability has been found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c CVE-2026-41753.5A vulnerability was determined in Aureus ERP up to 1.3.0-BETA2. The affected element is an unknown function of the file plugins/webkul/chatt CVE-2026-41769.8Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compres