Security advisories (VSA)
All published Vates Security Advisories, one page per advisory with the impact, affected versions, mitigation and the packages fixing the issue. Search by VSA identifier, CVE or XSA number, or filter by severity, product and year; you can also browse by year in the sidebar.
56 advisories, showing 1-10
| Advisory | Published | Severity | Affected products | References |
|---|---|---|---|---|
| VSA-2026-050eMudhra Intermediate CA Compromise | 2026-10-22 | Important | XCP-ng 8.3/Xen Orchestra Appliance | |
| VSA-2026-049Out-of-bounds access in tapdisk (CVE-2026-102701 / XSA-521) | 2026-10-13 | Critical | XCP-ng 8.3 | XSA-521, CVE-2026-102701 |
| VSA-2026-048gnttab cache-flush handling may cause a page reference leak (CVE-2026-102700 / XSA-520) | 2026-10-13 | Important | XCP-ng 8.3 | XSA-520, XSA-232, CVE-2026-102700, CVE-2017-14318 |
| VSA-2026-047VMX VMentry failure with branch tracing and blocked states (CVE-2026-79611 / XSA-518) | 2026-10-13 | Moderate | XCP-ng 8.3 | XSA-518, XSA-308, CVE-2026-79611 |
| VSA-2026-046grant-table double version change race (CVE-2026-79610 / XSA-517) | 2026-10-13 | Important | XCP-ng 8.3 | XSA-517, XSA-501, CVE-2026-79610 |
| VSA-2026-045Ineffectual Zenbleed workaround (CVE-2026-79608 / XSA-515) | 2026-10-13 | Important | XCP-ng 8.3 | XSA-515, XSA-433, CVE-2026-79608, CVE-2023-20593 |
| VSA-2026-044Privilege Escalation to Global Administrator via Prototype Pollution through Attacker-Controlled VMware VMX in `vm.importFromEsxi` | 2026-09-30 | Important | Xen Orchestra / Xen Orchestra Appliance | |
| VSA-2026-040DLL sideloading vulnerability in XenClean | 2026-09-14 | Low | XCP-ng Windows Guest Tools | |
| VSA-2026-039Out-of-bounds accesses in Tapdisk (CVE-2026-79605, CVE-2026-79606 / XSA-513) | 2026-09-08 | Critical | XCP-ng 8.3 | XSA-513, CVE-2026-79605, CVE-2026-79606 |
| VSA-2026-038Unbounded accumulation of watches in oxenstored (CVE-2026-79604 / XSA-512) | 2026-09-08 | Moderate | XCP-ng 8.3 | XSA-512, CVE-2026-79604 |
Page 1 of 6
Subscribe
Security teams can follow VSA publications without watching this page:
- RSS feed: /vsa/rss.xml
- Machine-readable index: /vsa/index.json, the same data that powers the list above, for scripts and vulnerability management tooling.
Was this page helpful?