vatesfr has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.5 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- xen-orchestra 2
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-110111High· 7.5Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods41CVE-2026-113610Medium· 5.4Xen Orchestra before 6.9.0 Authorization Bypass via user.set API30
vatesfr vulnerabilities
CVEs affecting vatesfr, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-113610Medium· 5.4Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. At…
▾ Sunlitvatesfr · xen-orchestravia CVEORG
CVE-2026-110111High· 7.5Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers …
▾ Twilightvatesfr · xen-orchestraEPSS 0.62%via NVD