# Xen.

Every CVE that names Xen among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [arbitrary read/write via grant copy](https://agentprime.io/advisories/CVE-2026-102704.md)
  `CVE-2026-102704` · CVE record: Xen Xen · CVSS 4.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-693
- [arbitrary read/write via grant copy](https://agentprime.io/advisories/CVE-2026-102703.md)
  `CVE-2026-102703` · CVE record: Xen Xen · CVSS 4.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-704
- [gnttab: cache-flush handling may cause page reference leak](https://agentprime.io/advisories/CVE-2026-102700.md)
  `CVE-2026-102700` · CVE record: Xen Xen · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Denial of service
- [Arm: multiple issues with GNTTABOP_cache_flush](https://agentprime.io/advisories/CVE-2026-102702.md)
  `CVE-2026-102702` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Arm: multiple issues with GNTTABOP_cache_flush](https://agentprime.io/advisories/CVE-2026-102699.md)
  `CVE-2026-102699` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [VMX: VMentry failure with branch tracing and blocked states](https://agentprime.io/advisories/CVE-2026-79611.md)
  `CVE-2026-79611` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [grant-table: double version change race](https://agentprime.io/advisories/CVE-2026-79610.md)
  `CVE-2026-79610` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [x86: XPTI may break on huge-memory systems](https://agentprime.io/advisories/CVE-2026-79609.md)
  `CVE-2026-79609` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [x86/AMD: ineffectual Zenbleed workaround](https://agentprime.io/advisories/CVE-2026-79608.md)
  `CVE-2026-79608` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-670
- [Xenstore: Guests can crash xenstored during Live Update](https://agentprime.io/advisories/CVE-2026-79607.md)
  `CVE-2026-79607` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Unconditionally do TLB flushing ahead of page scrubbing](https://agentprime.io/advisories/CVE-2026-79603.md)
  `CVE-2026-79603` · CVE record: Xen Xen · CVSS 4.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-664
- [x86: improper handling of HVM emulation return codes](https://agentprime.io/advisories/CVE-2026-79602.md)
  `CVE-2026-79602` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [x86: DMs may cause mem leak by IRQ binding](https://agentprime.io/advisories/CVE-2026-62437.md)
  `CVE-2026-62437` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Race condition
- [PoD: Don't try to reclaim special pages](https://agentprime.io/advisories/CVE-2026-62434.md)
  `CVE-2026-62434` · CVE record: Xen Xen · CVSS 5.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption
- [correct buffer checks for DM_OP hypercalls](https://agentprime.io/advisories/CVE-2026-62433.md)
  `CVE-2026-62433` · CVE record: Xen Xen · CVSS 7.3 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-665
- [evtchn: Race between FIFO expand and reset](https://agentprime.io/advisories/CVE-2026-62432.md)
  `CVE-2026-62432` · CVE record: Xen Xen · CVSS 7.3 High · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [Viridian STIMER division by zero](https://agentprime.io/advisories/CVE-2026-62431.md)
  `CVE-2026-62431` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service
- [x86: Out-of-bounds read in vRTC emulation](https://agentprime.io/advisories/CVE-2026-62430.md)
  `CVE-2026-62430` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [vNUMA domain cleanup may race other operations](https://agentprime.io/advisories/CVE-2026-62429.md)
  `CVE-2026-62429` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [grant-table: version change racing with other operations](https://agentprime.io/advisories/CVE-2026-62436.md)
  `CVE-2026-62436` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [grant-table: version change racing with other operations](https://agentprime.io/advisories/CVE-2026-62435.md)
  `CVE-2026-62435` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [grant-table: type confusion in grant-copy](https://agentprime.io/advisories/CVE-2026-62428.md)
  `CVE-2026-62428` · CVE record: Xen Xen · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Race condition
- [sysctl and platform-op locks open to abuse](https://agentprime.io/advisories/CVE-2026-62427.md)
  `CVE-2026-62427` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Broken access control, CWE-305
- [sysctl and platform-op locks open to abuse](https://agentprime.io/advisories/CVE-2026-62426.md)
  `CVE-2026-62426` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-412, CWE-667
- [buffer overruns in libfsimage iso9660 handling](https://agentprime.io/advisories/CVE-2026-62425.md)
  `CVE-2026-62425` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-20
- [buffer overruns in libfsimage iso9660 handling](https://agentprime.io/advisories/CVE-2026-62424.md)
  `CVE-2026-62424` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-130
- [buffer overruns in libfsimage iso9660 handling](https://agentprime.io/advisories/CVE-2026-62423.md)
  `CVE-2026-62423` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-130
- [buffer overruns in libfsimage iso9660 handling](https://agentprime.io/advisories/CVE-2026-42495.md)
  `CVE-2026-42495` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption
- [buffer overruns in libfsimage iso9660 handling](https://agentprime.io/advisories/CVE-2026-42494.md)
  `CVE-2026-42494` · CVE record: Xen Xen · CVSS 6.1 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption
- [vIRQ event channel binding may break Xenstore](https://agentprime.io/advisories/CVE-2026-42492.md)
  `CVE-2026-42492` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-459
- [x86 shadow paging is deprecated](https://agentprime.io/advisories/CVE-2026-42493.md)
  `CVE-2026-42493` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service
- [x86: mismatched mapcache metadata](https://agentprime.io/advisories/CVE-2026-42488.md)
  `CVE-2026-42488` · CVE record: Xen Xen · CVSS 8.1 High · Not analysed yet · Published 18 Jun 2026 · Tags: Memory corruption
- [domctl lock open to abuse](https://agentprime.io/advisories/CVE-2026-42490.md)
  `CVE-2026-42490` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-667
- [domctl lock open to abuse](https://agentprime.io/advisories/CVE-2026-42489.md)
  `CVE-2026-42489` · CVE record: Xen Xen · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-667
- [x86 HVM I/O port list traversal](https://agentprime.io/advisories/CVE-2026-42487.md)
  `CVE-2026-42487` · CVE record: Xen Xen · CVSS 7.9 High · Not analysed yet · Published 18 Jun 2026 · Tags: Race condition
- [grant table v2 race in status page mapping](https://agentprime.io/advisories/CVE-2026-23558.md)
  `CVE-2026-23558` · CVE record: Xen Xen · CVSS 7.8 High · Not analysed yet · Published 19 May 2026 · Tags: Race condition
- [Xenstored DoS via XS_RESET_WATCHES command](https://agentprime.io/advisories/CVE-2026-23557.md)
  `CVE-2026-23557` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Denial of service
- [Xenstored DoS by unprivileged domain](https://agentprime.io/advisories/CVE-2026-23555.md)
  `CVE-2026-23555` · CVE record: Xen Xen · CVSS 7.1 High · Not analysed yet · Published 23 Mar 2026 · Tags: Denial of service
- [Use after free of paging structures in EPT](https://agentprime.io/advisories/CVE-2026-23554.md)
  `CVE-2026-23554` · CVE record: Xen Xen · CVSS 7.8 High · Not analysed yet · Published 23 Mar 2026 · Tags: Race condition
- [x86: incomplete IBPB for vCPU isolation](https://agentprime.io/advisories/CVE-2026-23553.md)
  `CVE-2026-23553` · CVE record: Xen Xen · CVSS 2.9 Low · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-665, CWE-693
- [x86: buffer overrun with shadow paging + tracing](https://agentprime.io/advisories/CVE-2025-58150.md)
  `CVE-2025-58150` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 28 Jan 2026 · Tags: Memory corruption
- [Incorrect removal of permissions on PCI device unplug](https://agentprime.io/advisories/CVE-2025-58149.md)
  `CVE-2025-58149` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-672
- [x86: Incorrect input sanitisation in Viridian hypercalls](https://agentprime.io/advisories/CVE-2025-58148.md)
  `CVE-2025-58148` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2025 · Tags: Memory corruption
- [x86: Incorrect input sanitisation in Viridian hypercalls](https://agentprime.io/advisories/CVE-2025-58147.md)
  `CVE-2025-58147` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2025 · Tags: Memory corruption
- [Arm issues with page refcounting](https://agentprime.io/advisories/CVE-2025-58145.md)
  `CVE-2025-58145` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2025 · Tags: Race condition
- [Arm issues with page refcounting](https://agentprime.io/advisories/CVE-2025-58144.md)
  `CVE-2025-58144` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2025 · Tags: Memory corruption
- [Mutiple vulnerabilities in the Viridian interface](https://agentprime.io/advisories/CVE-2025-58143.md)
  `CVE-2025-58143` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-366
- [Mutiple vulnerabilities in the Viridian interface](https://agentprime.io/advisories/CVE-2025-58142.md)
  `CVE-2025-58142` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-395
- [Mutiple vulnerabilities in the Viridian interface](https://agentprime.io/advisories/CVE-2025-27466.md)
  `CVE-2025-27466` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-395
- [deadlock potential with VT-d and legacy PCI device pass-through](https://agentprime.io/advisories/CVE-2025-1713.md)
  `CVE-2025-1713` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2025 · Tags: Denial of service
- [x86: Incorrect stubs exception handling for flags recovery](https://agentprime.io/advisories/CVE-2025-27465.md)
  `CVE-2025-27465` · CVE record: Xen Xen · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-755
- [Xapi: Metadata injection attack against backup/restore functionality](https://agentprime.io/advisories/CVE-2024-31144.md)
  `CVE-2024-31144` · CVE record: Xen Project Xen · CVSS 3.8 Low · Not analysed yet · Published 14 Feb 2025
- [CVE-2024-2201](https://agentprime.io/advisories/CVE-2024-2201.md)
  `CVE-2024-2201` · CVE record: Xen Xen · CVSS 4.7 Medium · Not analysed yet · Published 19 Dec 2024
- [libxl leaks data to PVH guests via ACPI tables](https://agentprime.io/advisories/CVE-2024-45819.md)
  `CVE-2024-45819` · CVE record: Xen Xen · CVSS 5.5 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Broken access control
- [Deadlock in x86 HVM standard VGA handling](https://agentprime.io/advisories/CVE-2024-45818.md)
  `CVE-2024-45818` · CVE record: Xen Xen · CVSS 6.5 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: CWE-667
- [x86: Deadlock in vlapic_error()](https://agentprime.io/advisories/CVE-2024-45817.md)
  `CVE-2024-45817` · CVE record: Xen Xen · CVSS 7.3 High · Not analysed yet · Published 25 Sept 2024 · Tags: Information disclosure
- [PCI device pass-through with shared resources](https://agentprime.io/advisories/CVE-2024-31146.md)
  `CVE-2024-31146` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2024 · Tags: Denial of service
- [error handling in x86 IOMMU identity mapping](https://agentprime.io/advisories/CVE-2024-31145.md)
  `CVE-2024-31145` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2024 · Tags: Denial of service
- [double unlock in x86 guest IRQ handling](https://agentprime.io/advisories/CVE-2024-31143.md)
  `CVE-2024-31143` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 18 Jul 2024 · Tags: CWE-832
- [x86: Incorrect logic for BTC/SRSO mitigations](https://agentprime.io/advisories/CVE-2024-31142.md)
  `CVE-2024-31142` · CVE record: Xen Xen · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 16 May 2024 · Tags: CWE-693

Older: <https://agentprime.io/advisories/technology/xen.md?cursor=WyIyMDI0LTA1LTE2VDEzOjM5OjQyLjc3NDAwMFoiLCJDVkUtMjAyNC0zMTE0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=xen>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/xen/>. Everything for agents: <https://agentprime.io/llms.txt>.