Vates Security Advisories

Vates Security Advisories https://docs.vates.tech/security-advisories/ Security advisories (VSA) for the Vates VMS stack: XCP-ng, Xen Orchestra and add-ons. en VSA-2026-023: XAPI Missing TLS verification in some SDKs (CVE-2026-42491 / XSA-498) (N/A) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-023 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-023 Wed, 15 Jul 2026 12:00:00 GMT 2026-07-15 / Not applicable / SDK not directly used by XCP-ng. VSA-2026-022: LLDPD vulnerability in VLAN decapsulation (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-022 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-022 Tue, 23 Jun 2026 12:00:00 GMT 2026-06-23 / Low severity / XCP-ng 8.3 affected. VSA-2026-021: Linux Kernel CIFS Client Local Privilege Escalation (CVE-2026-46243) (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-021 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-021 Wed, 10 Jun 2026 12:00:00 GMT 2026-06-10 / Moderate severity / XCP-ng and XOA affected. VSA-2026-020: x86 mismatched mapcache metadata (XSA-494) (N/A) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-020 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-020 Wed, 10 Jun 2026 12:00:00 GMT 2026-06-10 / Not applicable / Only affects PV guests. VSA-2026-019: Arm TLBI completion issue (XSA-493) (N/A) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-019 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-019 Wed, 10 Jun 2026 12:00:00 GMT 2026-06-10 / Not applicable / Arm-only vulnerability. VSA-2026-018: domctl lock open to abuse (XSA-492) (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-018 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-018 Wed, 10 Jun 2026 12:00:00 GMT 2026-06-10 / Low severity / XCP-ng 8.3 affected. VSA-2026-017: x86 HVM I/O port list traversal (XSA-491) (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-017 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-017 Wed, 10 Jun 2026 12:00:00 GMT 2026-06-10 / Low severity / XCP-ng 8.3 affected. VSA-2026-016: Linux Kernel ptrace and RDS Local Privilege Escalation (CVE-2026-46333, CVE-2026-43494) (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-016 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-016 Tue, 02 Jun 2026 12:00:00 GMT 2026-06-02 / Moderate severity / XCP-ng and XOA affected. VSA-2026-015: x86 CPU Opcode Cache corruption (XSA-490) (Critical) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-015 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-015 Thu, 21 May 2026 12:00:00 GMT 2026-05-21 / Critical severity / XCP-ng 8.3 affected VSA-2026-014: Linux Kernel XFRM/RXRPC Local Privilege Escalation (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-014 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-014 Fri, 15 May 2026 12:00:00 GMT 2026-05-15 / Moderate severity / XCP-ng and XOA affected. VSA-2026-012: Vulnerability in XCP-ng Windows Guest Tools (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-012 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-012 Tue, 05 May 2026 12:00:00 GMT 2026-05-05 / Low severity / XCP-ng Windows Guest Tools affected. VSA-2026-013: Copy Fail - Linux Kernel Privilege Escalation (CVE-2026-31431) (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-013 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-013 Mon, 04 May 2026 12:00:00 GMT 2026-05-04 / Moderate severity / XCP-ng and XOA affected. VSA-2026-011: Multiple XAPI potential Vulnerabilities (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-011 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-011 Tue, 28 Apr 2026 12:00:00 GMT 2026-04-28 / Low severity / 8.3 affected. VSA-2026-010: Floating Point Divider State Sampling on AMD CPUs (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-010 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-010 Tue, 28 Apr 2026 12:00:00 GMT 2026-04-28 / Moderate severity / XCP-ng 8.3 affected. VSA-2026-009: OpenSSH ECDSA & CA vulnerabilities (Moderate) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-009 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-009 Tue, 28 Apr 2026 12:00:00 GMT 2026-04-28 / Moderate severity / XCP-ng 8.3 affected. VSA-2026-008: XSA-486 (Critical) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-008 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-008 Tue, 28 Apr 2026 12:00:00 GMT 2026-04-28 / Critical severity / XCP-ng 8.3 affected. VSA-2026-007: XSA-483 (Critical) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-007 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-007 Tue, 28 Apr 2026 12:00:00 GMT 2026-04-28 / Critical severity / XCP-ng 8.3 affected. VSA-2026-006: Issue with scrubbing of physmap allocated pages (Important) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-006 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-006 Thu, 26 Mar 2026 12:00:00 GMT 2026-03-24 / Important severity / XCP-ng 8.3 affected. VSA-2026-005: XSA-480 (Critical) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-005 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-005 Tue, 17 Mar 2026 12:00:00 GMT 2026-03-17 / Critical severity / XCP-ng 8.3 affected. VSA-2026-004: Node-Tar (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-004 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-004 Thu, 29 Jan 2026 12:00:00 GMT 2026-01-29 / Low severity / XO is affected. VSA-2026-003: XSA-479 (Important) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-003 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-003 Tue, 27 Jan 2026 12:00:00 GMT 2026-01-27 / Important severity / XCP-ng 8.3 affected. VSA-2026-002: XSA-478 (Critical) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-002 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-002 Tue, 27 Jan 2026 12:00:00 GMT 2026-01-27 / Critical severity / XCP-ng 8.3 affected. VSA-2026-001: XSA-477 (Low) https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-001 https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-001 Tue, 27 Jan 2026 12:00:00 GMT 2026-01-27 / Low severity / XCP-ng 8.3 affected. VSA-2025-009: RDSEED Failure on AMD "Zen5" (Low) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-009 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-009 Thu, 18 Dec 2025 12:00:00 GMT 2025-12-18 / Low severity / XCP-ng 8.3 affected. VSA-2025-003: Xen Orchestra SAML plugin Vulnerability (Important) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-003 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-003 Tue, 04 Nov 2025 12:00:00 GMT 2025-11-04 / Important severity / Xen-Orchestra prior to 5.111.1 affected. VSA-2025-008: XSA-476 - Xen Vulnerability (Low) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-008 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-008 Fri, 24 Oct 2025 12:00:00 GMT 2025-10-24 / Low severity / XCP-ng 8.3 affected. VSA-2025-007: Intel microcode update (Important) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-007 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-007 Thu, 23 Oct 2025 12:00:00 GMT 2025-10-23 / Important severity / XCP-ng 8.3 affected. VSA-2025-004: Libtpms Vulnerability (Low) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-004 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-004 Thu, 23 Oct 2025 12:00:00 GMT 2025-10-23 / Low severity / XCP-ng 8.3 affected. VSA-2025-006: XSA-475 - Xen Vulnerabilities (Critical) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-006 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-006 Tue, 21 Oct 2025 12:00:00 GMT 2025-10-23 / Critical severity / XCP-ng 8.3 affected. VSA-2025-005: Redis vulnerabilities (Low) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-005 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-005 Thu, 09 Oct 2025 12:00:00 GMT 2025-10-09 / Low severity / None of XO affected. VSA-2025-002: Xen and XAPI Vulnerabilities (Critical) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-002 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-002 Thu, 11 Sep 2025 12:00:00 GMT 2025-09-11 / Critical severity / XCP-ng 8.2 & 8.3 affected. VSA-2025-001: npm supply chain attack (Low) https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-001 https://docs.vates.tech/security-advisories/advisories/2025/vates-sa-2025-001 Wed, 10 Sep 2025 12:00:00 GMT 2025-09-10 / Low severity / Only XO devel affected.