Broadcom vulnerabilities
We track 127 vulnerabilities in Broadcom products across 31 products. 126 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 8, 2026.
Latest Broadcom vulnerabilities
- 9.8 Critical severity
XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to…
XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote attackers to execute arbitrary commands with elevated privileges.
- 9.8 Critical severity
Apache Log4j 1.x: Improper Neutralization of Special Elements used in an SQL Command
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate
- 8.8 High severity
Apache Log4j 1.x: Deserialization of Untrusted Data
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Topi
- 9.0 Critical severity
Apache HTTP Server-Side Request Forgery (SSRF) Exploited
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- 7.8 High severity
Linux Kernel Heap Out-of-Bounds Write Exploited
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
- 9.8 Critical severity
VMware Tanzu Spring Data Commons Property Binder Exploited
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supp
- 7.5 High severity
OpenSSL Information Disclosure Exploited
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, a