XEN vulnerabilities
153 CVEs and advisories name XEN as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-42493x86 shadow paging is deprecated
- CVE-2026-42486Multiple RBAC issues in XAPI
- CVE-2026-23562Multiple RBAC issues in XAPI
- CVE-2026-23561Multiple RBAC issues in XAPI
- CVE-2026-23560Multiple RBAC issues in XAPI
- CVE-2026-23559Multiple RBAC issues in XAPI
- CVE-2026-23556oxenstored keeps quota related use counts across domain destruction
- CVE-2025-58151varstored: TOCTOU issues with mapped guest memory
- CVE-2025-58146XAPI UTF-8 string handling
- CVE-2025-27464WinPVDrivers: Excessive permissions on user-exposed devices
- CVE-2025-27463WinPVDrivers: Excessive permissions on user-exposed devices
- CVE-2025-27462WinPVDrivers: Excessive permissions on user-exposed devices
- CVE-2026-42488x86: mismatched mapcache metadata
- CVE-2026-42490domctl lock open to abuse
- CVE-2026-42489domctl lock open to abuse
- CVE-2026-42487x86 HVM I/O port list traversal
- CVE-2026-23558grant table v2 race in status page mapping
- CVE-2026-23557Xenstored DoS via XS_RESET_WATCHES command
- CVE-2026-23555Xenstored DoS by unprivileged domain
- CVE-2026-23554Use after free of paging structures in EPT
- CVE-2026-23553x86: incomplete IBPB for vCPU isolation
- CVE-2025-58150x86: buffer overrun with shadow paging + tracing
- CVE-2025-58149Incorrect removal of permissions on PCI device unplug
- CVE-2025-58148x86: Incorrect input sanitisation in Viridian hypercalls
- CVE-2025-58147x86: Incorrect input sanitisation in Viridian hypercalls
- CVE-2025-58145Arm issues with page refcounting
- CVE-2025-58144Arm issues with page refcounting
- CVE-2025-58143Mutiple vulnerabilities in the Viridian interface
- CVE-2025-58142Mutiple vulnerabilities in the Viridian interface
- CVE-2025-27466Mutiple vulnerabilities in the Viridian interface