Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0942
Vulnerability from certfr_avis - Published: 2026-07-29 - Updated: 2026-07-29
De multiples vulnérabilités ont été découvertes dans Xen. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Xen toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Xen",
"vendor": {
"name": "XEN",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-62429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62429"
},
{
"name": "CVE-2026-62423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62423"
},
{
"name": "CVE-2026-42492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42492"
},
{
"name": "CVE-2026-42495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42495"
},
{
"name": "CVE-2026-62427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62427"
},
{
"name": "CVE-2026-62424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62424"
},
{
"name": "CVE-2026-62426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62426"
},
{
"name": "CVE-2026-62428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62428"
},
{
"name": "CVE-2026-62436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62436"
},
{
"name": "CVE-2026-42493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42493"
},
{
"name": "CVE-2026-62434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62434"
},
{
"name": "CVE-2026-62433",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62433"
},
{
"name": "CVE-2026-62432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62432"
},
{
"name": "CVE-2026-62430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62430"
},
{
"name": "CVE-2026-42494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42494"
},
{
"name": "CVE-2026-62435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62435"
},
{
"name": "CVE-2026-62431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62431"
},
{
"name": "CVE-2026-62425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62425"
}
],
"initial_release_date": "2026-07-29T00:00:00",
"last_revision_date": "2026-07-29T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0942",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-29T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Xen. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Xen",
"vendor_advisories": [
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-495",
"url": "https://xenbits.xen.org/xsa/advisory-495.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-501",
"url": "https://xenbits.xen.org/xsa/advisory-501.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-504",
"url": "https://xenbits.xen.org/xsa/advisory-504.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-500",
"url": "https://xenbits.xen.org/xsa/advisory-500.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-499",
"url": "https://xenbits.xen.org/xsa/advisory-499.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-508",
"url": "https://xenbits.xen.org/xsa/advisory-508.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-496",
"url": "https://xenbits.xen.org/xsa/advisory-496.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-506",
"url": "https://xenbits.xen.org/xsa/advisory-506.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-507",
"url": "https://xenbits.xen.org/xsa/advisory-507.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-503",
"url": "https://xenbits.xen.org/xsa/advisory-503.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-505",
"url": "https://xenbits.xen.org/xsa/advisory-505.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-502",
"url": "https://xenbits.xen.org/xsa/advisory-502.html"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Xen xsa/advisory-497",
"url": "https://xenbits.xen.org/xsa/advisory-497.html"
}
]
}
CVE-2026-62429 (GCVE-0-2026-62429)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vNUMA domain cleanup may race other operations
Summary
Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration information is not synchronized with its retrieval by a
device model controlling the guest.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:56 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:29.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-502.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:56:13.716116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:51:45.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-502"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly entities controlling guests (on x86: HVM guests) can leverage the\nvulnerability. These are device models running in either a stub domain or\nde-privileged in Dom0.\n\nOnly guests which have vNUMA enabled allow their controlling entities to\nleverage the vulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Teddy Astie of Vates."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accessing the vNUMA configuration data of a guest is still possible when\ndomain destruction has already started. The cleaning up of that\nconfiguration information is not synchronized with its retrieval by a\ndevice model controlling the guest."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "While Denial of Service (DoS) affecting the entire host and information\nleaks and are the prevailing effect, a device model stub domain or a\nde-privileged device model running in the control domain may also be\nable to elevate its privileges to that of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:24.333Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-502.html"
}
],
"title": "vNUMA domain cleanup may race other operations",
"workarounds": [
{
"lang": "en",
"value": "On x86, running only PV or PVH guests will avoid the vulnerability.\n\nNot enabling vNUMA for HVM guests will also avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62429",
"datePublished": "2026-07-28T12:32:24.333Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:29.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62430 (GCVE-0-2026-62430)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
x86: Out-of-bounds read in vRTC emulation
Summary
Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:50 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:30.367Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-503.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:50:31.706627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:50:36.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-503"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.2 onwards are vulnerable. Xen versions 3.1 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accesses to the CMOS memory contents are done using an indirect IO port\npair. Therefore Xen needs to cache the guest chosen index, and one of\nthe usages of the index didn\u0027t take the necessary locking to avoid\nconcurrent changes. As a result, a guest could change the index after\nit being checked, causing a subsequent out-of-bound read access to the\ncontents of an array."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can read out-of-bounds, this is limited to Xen data, and not\ndata belonging to other guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:33.150Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-503.html"
}
],
"title": "x86: Out-of-bounds read in vRTC emulation",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62430",
"datePublished": "2026-07-28T12:32:33.150Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:30.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62431 (GCVE-0-2026-62431)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
Viridian STIMER division by zero
Summary
The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:49 UTC
CWE
- CWE-369 - Divide By Zero
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:31.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-504.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:49:03.810668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369 Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:49:09.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-504"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and\nearlier are not vulnerable.\n\nOnly HVM guests with Viridian STIMERs enabled can trigger the vulnerability."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The logic to handle periodic Viridian STIMERs performs a division with an\nunchecked user-controlled divisor value, that can be set to zero to cause a #DE\nfault."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial\nof Service (DoS) affecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:43.849Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-504.html"
}
],
"title": "Viridian STIMER division by zero",
"workarounds": [
{
"lang": "en",
"value": "Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.\n\nNote Viridian extensions are not enabled by default."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62431",
"datePublished": "2026-07-28T12:32:43.849Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:31.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62432 (GCVE-0-2026-62432)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
evtchn: Race between FIFO expand and reset
Summary
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:13 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:32.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-505.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:13:34.638706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:13:39.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-505"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:52.043Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"
}
],
"title": "evtchn: Race between FIFO expand and reset",
"workarounds": [
{
"lang": "en",
"value": "There are no mitigations."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62432",
"datePublished": "2026-07-28T12:32:52.043Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:32.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62433 (GCVE-0-2026-62433)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
correct buffer checks for DM_OP hypercalls
Summary
Parts of the DM_OP handling code assumes the caller has provided the
required number of buffers for the given operation without any checking
being done. As a result, certain operations might access stack
rubble as structures are possibly uninitialized.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:03 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:33.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-506.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:03:57.527525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:06:29.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-506"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.10 onwards are vulnerable. Xen versions 4.9 and\nearlier are not vulnerable.\n\nOnly entities controlling HVM guests can leverage the vulnerability.\nThese are device models running in either a stub domain or de-privileged\nin Dom0."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done. As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A device model of a HVM guest can gain insight on the contents of the\nXen stack, thus possibly leaking data from other guests contexts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:59.802Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
}
],
"title": "correct buffer checks for DM_OP hypercalls",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability.\n\n(Switching from a device model stub domain or a de-privileged device\nmodel to a fully privileged Dom0 device model does NOT mitigate this\nvulnerability. Rather, it simply recategorises the vulnerability to\nhostile management code, regarding it \"as designed\"; thus it merely\nreclassifies these issues as \"not a bug\". The security of a Xen system\nusing stub domains is still better than with a qemu-dm running as a Dom0\nprocess. Users and vendors of stub qemu dm systems should not change\ntheir configuration to use a Dom0 QEMU process.)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62433",
"datePublished": "2026-07-28T12:32:59.802Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:33.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62434 (GCVE-0-2026-62434)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:33 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
PoD: Don't try to reclaim special pages
Summary
A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:59 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:34.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-507.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:59:52.970334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:00:00.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-507"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest\u0027s xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren\u0027t regular guest RAM. This can cause corruption\nof memory management state in Xen."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A buggy or malicious guest can cause corruption of Xen\u0027s state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:33:08.540Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"
}
],
"title": "PoD: Don\u0027t try to reclaim special pages",
"workarounds": [
{
"lang": "en",
"value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62434",
"datePublished": "2026-07-28T12:33:08.540Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:34.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62435 (GCVE-0-2026-62435)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:19
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:19 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:19:26.810813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:19:30.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.287Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62435",
"datePublished": "2026-07-28T12:32:16.287Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:19:30.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62436 (GCVE-0-2026-62436)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:17
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:16 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:16:28.153900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:17:33.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.344Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62436",
"datePublished": "2026-07-28T12:32:16.344Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:17:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…