Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: vatesfr Clear all filters
TI-2026-76939 CVE-2026-113610 · GHSA-22x8-669x-gh7m

Authorization bypass in Xen Orchestra user.set API lets users alter others

Priority LOW 24

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary t…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00426 Published 2026-10-20 Fixed in 6.9.0 CWE-639
TI-2026-73416 CVE-2026-110111 · GHSA-9p53-2254-x397

Prototype pollution in Xen Orchestra enables privilege escalation

Priority LOW 37

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi me…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00617 Published 2026-10-13 Fixed in 6.9.0 CWE-1321