{
  "source": "https://docs.vates.tech/vsa/index.json",
  "advisories": [
    {
      "id": "VSA-2026-023",
      "title": "XAPI Missing TLS verification in some SDKs (CVE-2026-42491 / XSA-498)",
      "published": "2026-07-15",
      "updated": "2026-07-15",
      "severity": "N/A",
      "cvss": "Not available yet",
      "products": [
        "None (SDK not used)"
      ],
      "productTags": [
        "None"
      ],
      "cve": [
        "CVE-2026-42491"
      ],
      "xsa": [
        "XSA-498"
      ],
      "summary": "2026-07-15 / Not applicable / SDK not directly used by XCP-ng.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-023"
    },
    {
      "id": "VSA-2026-022",
      "title": "LLDPD vulnerability in VLAN decapsulation",
      "published": "2026-06-23",
      "updated": "2026-06-23",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-46433"
      ],
      "xsa": [],
      "summary": "2026-06-23 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-022"
    },
    {
      "id": "VSA-2026-021",
      "title": "Linux Kernel CIFS Client Local Privilege Escalation (CVE-2026-46243)",
      "published": "2026-06-10",
      "updated": "2026-06-23",
      "severity": "Moderate",
      "cvss": "Not Available yet",
      "products": [
        "XCP-ng, XOA"
      ],
      "productTags": [
        "XCP-ng",
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2026-46243"
      ],
      "xsa": [],
      "summary": "2026-06-10 / Moderate severity / XCP-ng and XOA affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-021"
    },
    {
      "id": "VSA-2026-020",
      "title": "x86 mismatched mapcache metadata (XSA-494)",
      "published": "2026-06-10",
      "updated": "2026-06-23",
      "severity": "N/A",
      "cvss": "Not available yet",
      "products": [
        "None (PV only)"
      ],
      "productTags": [
        "None"
      ],
      "cve": [
        "CVE-2026-42488"
      ],
      "xsa": [
        "XSA-494"
      ],
      "summary": "2026-06-10 / Not applicable / Only affects PV guests.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-020"
    },
    {
      "id": "VSA-2026-019",
      "title": "Arm TLBI completion issue (XSA-493)",
      "published": "2026-06-10",
      "updated": "2026-06-10",
      "severity": "N/A",
      "cvss": "Not available yet",
      "products": [
        "None (Arm only)"
      ],
      "productTags": [
        "None"
      ],
      "cve": [
        "CVE-2025-10263"
      ],
      "xsa": [
        "XSA-493"
      ],
      "summary": "2026-06-10 / Not applicable / Arm-only vulnerability.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-019"
    },
    {
      "id": "VSA-2026-018",
      "title": "domctl lock open to abuse (XSA-492)",
      "published": "2026-06-10",
      "updated": "2026-06-23",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-42489",
        "CVE-2026-42490"
      ],
      "xsa": [
        "XSA-492"
      ],
      "summary": "2026-06-10 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-018"
    },
    {
      "id": "VSA-2026-017",
      "title": "x86 HVM I/O port list traversal (XSA-491)",
      "published": "2026-06-10",
      "updated": "2026-06-23",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-42487"
      ],
      "xsa": [
        "XSA-491"
      ],
      "summary": "2026-06-10 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-017"
    },
    {
      "id": "VSA-2026-016",
      "title": "Linux Kernel ptrace and RDS Local Privilege Escalation (CVE-2026-46333, CVE-2026-43494)",
      "published": "2026-06-02",
      "updated": "2026-06-02",
      "severity": "Moderate",
      "cvss": "5.5 and 7.8",
      "products": [
        "XCP-ng, XOA"
      ],
      "productTags": [
        "XCP-ng",
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2026-46333",
        "CVE-2026-43494"
      ],
      "xsa": [],
      "summary": "2026-06-02 / Moderate severity / XCP-ng and XOA affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-016"
    },
    {
      "id": "VSA-2026-015",
      "title": "x86 CPU Opcode Cache corruption (XSA-490)",
      "published": "2026-05-21",
      "updated": "2026-05-21",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-54518"
      ],
      "xsa": [
        "XSA-490"
      ],
      "summary": "2026-05-21 / Critical severity / XCP-ng 8.3 affected",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-015"
    },
    {
      "id": "VSA-2026-014",
      "title": "Linux Kernel XFRM/RXRPC Local Privilege Escalation (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300)",
      "published": "2026-05-15",
      "updated": "2026-06-02",
      "severity": "Moderate",
      "cvss": "7.8",
      "products": [
        "XCP-ng, XOA"
      ],
      "productTags": [
        "XCP-ng",
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2026-43284",
        "CVE-2026-43500",
        "CVE-2026-46300"
      ],
      "xsa": [],
      "summary": "2026-05-15 / Moderate severity / XCP-ng and XOA affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-014"
    },
    {
      "id": "VSA-2026-012",
      "title": "Vulnerability in XCP-ng Windows Guest Tools",
      "published": "2026-05-05",
      "updated": "2026-05-05",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng Windows Guest Tools"
      ],
      "productTags": [
        "XCP-ng",
        "Guest Tools"
      ],
      "cve": [],
      "xsa": [],
      "summary": "2026-05-05 / Low severity / XCP-ng Windows Guest Tools affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-012"
    },
    {
      "id": "VSA-2026-013",
      "title": "Copy Fail - Linux Kernel Privilege Escalation (CVE-2026-31431)",
      "published": "2026-05-04",
      "updated": "2026-05-12",
      "severity": "Moderate",
      "cvss": "7.8",
      "products": [
        "XCP-ng 8.3 and XOA"
      ],
      "productTags": [
        "XCP-ng",
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2026-31431"
      ],
      "xsa": [],
      "summary": "2026-05-04 / Moderate severity / XCP-ng and XOA affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-013"
    },
    {
      "id": "VSA-2026-011",
      "title": "Multiple XAPI potential Vulnerabilities",
      "published": "2026-04-28",
      "updated": "2026-05-05",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-23559",
        "CVE-2026-23560",
        "CVE-2026-23561",
        "CVE-2026-23562",
        "CVE-2026-42486"
      ],
      "xsa": [
        "XSA-489"
      ],
      "summary": "2026-04-28 / Low severity / 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-011"
    },
    {
      "id": "VSA-2026-010",
      "title": "Floating Point Divider State Sampling on AMD CPUs",
      "published": "2026-04-28",
      "updated": "2026-04-28",
      "severity": "Moderate",
      "cvss": "2.0",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-54505"
      ],
      "xsa": [
        "XSA-488"
      ],
      "summary": "2026-04-28 / Moderate severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-010"
    },
    {
      "id": "VSA-2026-009",
      "title": "OpenSSH ECDSA & CA vulnerabilities",
      "published": "2026-04-28",
      "updated": "2026-04-28",
      "severity": "Moderate",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-35414"
      ],
      "xsa": [],
      "summary": "2026-04-28 / Moderate severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-009"
    },
    {
      "id": "VSA-2026-008",
      "title": "XSA-486",
      "published": "2026-04-28",
      "updated": "2026-04-28",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-23558"
      ],
      "xsa": [
        "XSA-486"
      ],
      "summary": "2026-04-28 / Critical severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-008"
    },
    {
      "id": "VSA-2026-007",
      "title": "XSA-483",
      "published": "2026-04-28",
      "updated": "2026-04-29",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-23556"
      ],
      "xsa": [
        "XSA-483"
      ],
      "summary": "2026-04-28 / Critical severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-007"
    },
    {
      "id": "VSA-2026-006",
      "title": "Issue with scrubbing of physmap allocated pages",
      "published": "2026-03-26",
      "updated": "2026-04-27",
      "severity": "Important",
      "cvss": "Not available",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-4397"
      ],
      "xsa": [],
      "summary": "2026-03-24 / Important severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-006"
    },
    {
      "id": "VSA-2026-005",
      "title": "XSA-480",
      "published": "2026-03-17",
      "updated": "2026-03-19",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-23554"
      ],
      "xsa": [
        "XSA-480"
      ],
      "summary": "2026-03-17 / Critical severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-005"
    },
    {
      "id": "VSA-2026-004",
      "title": "Node-Tar",
      "published": "2026-01-29",
      "updated": "2026-01-29",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "Xen Orchestra"
      ],
      "productTags": [
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2026-23745"
      ],
      "xsa": [],
      "summary": "2026-01-29 / Low severity / XO is affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-004"
    },
    {
      "id": "VSA-2026-003",
      "title": "XSA-479",
      "published": "2026-01-27",
      "updated": "2026-01-29",
      "severity": "Important",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2026-23553"
      ],
      "xsa": [
        "XSA-479"
      ],
      "summary": "2026-01-27 / Important severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-003"
    },
    {
      "id": "VSA-2026-002",
      "title": "XSA-478",
      "published": "2026-01-27",
      "updated": "2026-01-27",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-58151"
      ],
      "xsa": [
        "XSA-478"
      ],
      "summary": "2026-01-27 / Critical severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-002"
    },
    {
      "id": "VSA-2026-001",
      "title": "XSA-477",
      "published": "2026-01-27",
      "updated": "2026-01-29",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-58150"
      ],
      "xsa": [
        "XSA-477"
      ],
      "summary": "2026-01-27 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-001"
    },
    {
      "id": "VSA-2025-009",
      "title": "RDSEED Failure on AMD \"Zen5\"",
      "published": "2025-12-18",
      "updated": "2025-12-18",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-62626"
      ],
      "xsa": [],
      "summary": "2025-12-18 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-009"
    },
    {
      "id": "VSA-2025-003",
      "title": "Xen Orchestra SAML plugin Vulnerability",
      "published": "2025-11-04",
      "updated": "2025-11-04",
      "severity": "Important",
      "cvss": "10.0",
      "products": [
        "Xen Orchestra prior to 5.111.1 with plugin Auth SAML"
      ],
      "productTags": [
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2025-54419"
      ],
      "xsa": [],
      "summary": "2025-11-04 / Important severity / Xen-Orchestra prior to 5.111.1 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-003"
    },
    {
      "id": "VSA-2025-008",
      "title": "XSA-476 - Xen Vulnerability",
      "published": "2025-10-24",
      "updated": "2025-12-18",
      "severity": "Low",
      "cvss": "Not available yet",
      "products": [
        "None"
      ],
      "productTags": [
        "None"
      ],
      "cve": [
        "CVE-2025-58149"
      ],
      "xsa": [
        "XSA-476"
      ],
      "summary": "2025-10-24 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-008"
    },
    {
      "id": "VSA-2025-007",
      "title": "Intel microcode update",
      "published": "2025-10-23",
      "updated": "2025-10-23",
      "severity": "Important",
      "cvss": "7.3, 5.3 and 7.3",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-20109",
        "CVE-2025-22840",
        "CVE-2025-22839"
      ],
      "xsa": [],
      "summary": "2025-10-23 / Important severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-007"
    },
    {
      "id": "VSA-2025-004",
      "title": "Libtpms Vulnerability",
      "published": "2025-10-23",
      "updated": "2025-10-23",
      "severity": "Low",
      "cvss": "5.9",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-49133"
      ],
      "xsa": [],
      "summary": "2025-10-23 / Low severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-004"
    },
    {
      "id": "VSA-2025-006",
      "title": "XSA-475 - Xen Vulnerabilities",
      "published": "2025-10-21",
      "updated": "2025-10-23",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-58147",
        "CVE-2025-58148"
      ],
      "xsa": [
        "XSA-475"
      ],
      "summary": "2025-10-23 / Critical severity / XCP-ng 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-006"
    },
    {
      "id": "VSA-2025-005",
      "title": "Redis vulnerabilities",
      "published": "2025-10-09",
      "updated": "2025-10-09",
      "severity": "Low",
      "cvss": "10.0 and 8.8",
      "products": [
        "None"
      ],
      "productTags": [
        "None"
      ],
      "cve": [
        "CVE-2025-49844",
        "CVE-2025-46817",
        "CVE-2025-46818",
        "CVE-2025-46819"
      ],
      "xsa": [],
      "summary": "2025-10-09 / Low severity / None of XO affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-005"
    },
    {
      "id": "VSA-2025-002",
      "title": "Xen and XAPI Vulnerabilities",
      "published": "2025-09-11",
      "updated": "2025-09-11",
      "severity": "Critical",
      "cvss": "Not available yet",
      "products": [
        "XCP-ng 8.2 and 8.3"
      ],
      "productTags": [
        "XCP-ng"
      ],
      "cve": [
        "CVE-2025-58146",
        "CVE-2025-27466",
        "CVE-2025-58142",
        "CVE-2025-58143"
      ],
      "xsa": [
        "XSA-472",
        "XSA-474"
      ],
      "summary": "2025-09-11 / Critical severity / XCP-ng 8.2 & 8.3 affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-002"
    },
    {
      "id": "VSA-2025-001",
      "title": "npm supply chain attack",
      "published": "2025-09-10",
      "updated": "2025-09-10",
      "severity": "Low",
      "cvss": "8.6 and 9.3",
      "products": [
        "Xen Orchestra (dev only)",
        "XOA (not affected)"
      ],
      "productTags": [
        "Xen Orchestra"
      ],
      "cve": [
        "CVE-2025-59038",
        "CVE-2025-59039"
      ],
      "xsa": [],
      "summary": "2025-09-10 / Low severity / Only XO devel affected.",
      "path": "https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-001"
    }
  ]
}