Vulnerabilities
Summary — last 7 days
New vulnerabilities3,454▼ 1,360 vs. last week
Critical / high1,321▼ 1,441 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)693▲ 630 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.3) | — | — | Vatesfr XEN OrchestraAI | 10/20/2026 | 10/20/2026 | Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor… | |
| Awaiting Analysis | High (7.7) | 0.62% | — | Vates XEN OrchestraAI | 10/13/2026 | 10/13/2026 | Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with… | |
| Modified | Medium (4.3) | 0.71% | — | Xen-orchestra Xo-serverXen-orchestra Xo-web | 7/12/2021 | 6/17/2026 | Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups. |