https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T05:12:33.351038+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-113610 fkie_cve-2026-113610 2026-10-21T05:12:33.352156+00:00

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

 https://db.gcve.eu/vuln/ghsa-22x8-669x-gh7m GHSA-22x8-669x-gh7m 2026-10-21T05:12:33.352220+00:00

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.