XE
Product
Xen
490
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 134Medium 162Low 11
Watch
Add Xen to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34324 | 4.9 | Jan 5 | Closing of an event channel in the Linux kernel can result in a deadlock Affected: All versions, or not specified |
| CVE-2021-28700 | 4.9 | Aug 27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen Affected: 4.12.0 and later |
| CVE-2024-2201 | 4.7 | Dec 19 | No description published yet Affected: See advisory "x86: Native Branch History Injection" |
| CVE-2023-46836 | 4.7 | Jan 5 | The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe Affected: All versions, or not specified |
| CVE-2020-25604 | 4.7 | Sep 23 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2016-4963 | 4.7 | Jun 7 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; +30 more |
| CVE-2022-23035 | 4.6 | Jan 25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular… Affected: 4.6.0 and later |
| CVE-2020-28368 | 4.4 | Nov 10 | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring… Affected: through 4.14.0 |
| CVE-2015-8552 | 4.4 | Apr 13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous… Affected: 3.1.3; 3.1.4; 3.2.0; 3.2.1; 3.2.2; 3.2.3; +32 more |
| CVE-2025-27465 | 4.3 | Jul 16 | Certain instructions need intercepting and emulating by Xen Affected: 4.9.0 and later |
| CVE-2023-46840 | 4.1 | Mar 20 | Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen Affected: 4.17 and later |
| CVE-2016-7094 | 4.1 | Sep 21 | Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update Affected: through 4.7.0 |