XE
Vendor
Xen
507
CVEs
0
On KEV
0
New 30D
Products
XE10.0
Xen
Xen
490 CVEs0 on KEV0 new
XA9.4
XAPI
Xen
9 CVEs0 on KEV0 new
WP9.4
Windows PV drivers
Xen
3 CVEs0 on KEV0 new
OX9.4
oxenstored
Xen
1 CVEs0 on KEV0 new
QE–
Qemu
Xen
1 CVEs0 on KEV0 new
VA9.4
varstored
Xen
1 CVEs0 on KEV0 new
XF–
Xen Flask Module
Xen
1 CVEs0 on KEV0 new
XE–
Xen-unstable
Xen
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42486 | XA XAPI Xen | 9.4 | Jul 9 | Multiple RBAC issues in XAPI |
| CVE-2026-23562 | XA XAPI Xen | 9.4 | Jul 9 | Multiple RBAC issues in XAPI |
| CVE-2026-23561 | XA XAPI Xen | 9.4 | Jul 9 | Multiple RBAC issues in XAPI |
| CVE-2026-23560 | XA XAPI Xen | 9.4 | Jul 9 | Multiple RBAC issues in XAPI |
| CVE-2026-23559 | XA XAPI Xen | 9.4 | Jul 9 | Multiple RBAC issues in XAPI |
| CVE-2026-23556 | OX oxenstored Xen | 9.4 | Jul 9 | oxenstored keeps quota related use counts across domain destruction |
| CVE-2025-58151 | VA varstored Xen | 9.4 | Jul 9 | varstored: TOCTOU issues with mapped guest memory |
| CVE-2025-58146 | XA XAPI Xen | 9.4 | Jul 9 | XAPI UTF-8 string handling |
| CVE-2025-27464 | WP Windows PV drivers Xen | 9.4 | Jul 9 | WinPVDrivers: Excessive permissions on user-exposed devices |
| CVE-2025-27463 | WP Windows PV drivers Xen | 9.4 | Jul 9 | WinPVDrivers: Excessive permissions on user-exposed devices |
| CVE-2025-27462 | WP Windows PV drivers Xen | 9.4 | Jul 9 | WinPVDrivers: Excessive permissions on user-exposed devices |
| CVE-2026-23558 | XE Xen Xen | 7.8 | May 19 | grant table v2 race in status page mapping |
| CVE-2026-23557 | XE Xen Xen | 6.5 | May 19 | Xenstored DoS via XS_RESET_WATCHES command |
| CVE-2026-23555 | XE Xen Xen | 7.1 | Mar 23 | Xenstored DoS by unprivileged domain |
| CVE-2026-23554 | XE Xen Xen | 7.8 | Mar 23 | Use after free of paging structures in EPT |
| CVE-2026-23553 | XE Xen Xen | 2.9 | Jan 28 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run |
| CVE-2025-58150 | XE Xen Xen | 8.8 | Jan 28 | Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing |
| CVE-2025-58149 | XE Xen Xen | 7.5 | Oct 31 | When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have |
| CVE-2025-58148 | XE Xen Xen | 7.5 | Oct 31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of… |
| CVE-2025-58147 | XE Xen Xen | 7.5 | Oct 31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of… |
| CVE-2025-58145 | XE Xen Xen | 7.5 | Sep 11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of… |
| CVE-2025-58144 | XE Xen Xen | 7.5 | Sep 11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of… |
| CVE-2025-58143 | XE Xen Xen | 9.8 | Sep 11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling… |
| CVE-2025-58142 | XE Xen Xen | 9.8 | Sep 11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling… |
| CVE-2025-27466 | XE Xen Xen | 9.8 | Sep 11 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling… |
| CVE-2025-1713 | XE Xen Xen | 7.5 | Jul 17 | When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required |
| CVE-2025-27465 | XE Xen Xen | 4.3 | Jul 16 | Certain instructions need intercepting and emulating by Xen |
| CVE-2024-31144 | XA Xapi Xen | 3.8 | Feb 14 | For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to backup and restore… |
| CVE-2024-2201 | XE Xen Xen | 4.7 | Dec 19 | No description published yet |
| CVE-2024-45819 | XE Xen Xen | 5.5 | Dec 19 | libxl leaks data to PVH guests via ACPI tables |
| CVE-2024-45818 | XE Xen Xen | 6.5 | Dec 19 | Deadlock in x86 HVM standard VGA handling |
| CVE-2024-45817 | XE Xen Xen | 7.3 | Sep 25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register |
| CVE-2024-31146 | XE Xen Xen | 7.5 | Sep 25 | When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be… |
| CVE-2024-31145 | XE Xen Xen | 7.5 | Sep 25 | Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for… |
| CVE-2024-31143 | XE Xen Xen | 7.5 | Jul 18 | An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors |
| CVE-2024-31142 | XE Xen Xen | 7.5 | May 16 | Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used |
| CVE-2023-46842 | XE Xen Xen | 6.5 | May 16 | Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes |
| CVE-2023-46841 | XE Xen Xen | 6.5 | Mar 20 | Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET) |
| CVE-2023-46840 | XE Xen Xen | 4.1 | Mar 20 | Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen |
| CVE-2023-46839 | XE Xen Xen | 5.3 | Mar 20 | PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise… |
| CVE-2023-46837 | XE Xen Xen | 3.3 | Jan 5 | Arm provides multiple helpers to clean & invalidate the cache for a given region |
| CVE-2023-46836 | XE Xen Xen | 4.7 | Jan 5 | The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe |
| CVE-2023-46835 | XE Xen Xen | 5.5 | Jan 5 | The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and… |
| CVE-2023-34328 | XE Xen Xen | 5.5 | Jan 5 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal… |
| CVE-2023-34327 | XE Xen Xen | 5.5 | Jan 5 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal… |
| CVE-2023-34326 | XE Xen Xen | 7.8 | Jan 5 | The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings)… |
| CVE-2023-34325 | XE Xen Xen | 7.8 | Jan 5 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several… |
| CVE-2023-34324 | XE Xen Xen | 4.9 | Jan 5 | Closing of an event channel in the Linux kernel can result in a deadlock |
| CVE-2023-34323 | XE Xen Xen | 5.5 | Jan 5 | When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes |
| CVE-2023-34322 | XE Xen Xen | 7.8 | Jan 5 | For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode |
| CVE-2023-34321 | XE Xen Xen | 3.3 | Jan 5 | Arm provides multiple helpers to clean & invalidate the cache for a given region |
| CVE-2023-34320 | XE Xen Xen | 5.5 | Dec 8 | Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device… |
| CVE-2023-4949 | XE Xen Xen | 6.7 | Nov 10 | An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory… |
| CVE-2023-34319 | XE Xen Xen | 7.8 | Sep 22 | Linux: buffer overrun in netback due to unusual packet |
| CVE-2022-40982 | XE Xen Xen | 6.5 | Aug 11 | Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to… |
| CVE-2023-20588 | XE Xen Xen | 5.5 | Aug 8 | A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality |
| CVE-2023-20593 | XE Xen Xen | 5.5 | Jul 24 | An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information |
| CVE-2022-4949 | XE Xen Xen | 8.8 | Jun 7 | The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1 |
| CVE-2022-42336 | XE Xen Xen | 3.3 | May 17 | Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is… |
| CVE-2022-42335 | XE Xen Xen | 7.8 | Apr 25 | x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will… |