XEN is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 126 CVE records since 2021.

How many CVEs has XEN published?

XEN has published 126 CVE records, including 24 in the last two years.

What is XEN's CVE data quality grade?

RadicalNotion.AI grades XEN's CVE data quality as F, with an overall completeness score of 58.5%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (0%), and CWE (34.1%) information.

What products does XEN publish CVEs for?

XEN most frequently publishes CVEs for Xen, debian linux, fedora, Linux, linux kernel.

Which vendors does XEN cover?

XEN publishes CVEs across 5 distinct vendors, most often Xen Project, debian, fedoraproject, Linux, arm.

Is XEN actively publishing CVEs?

XEN is currently active, based on 24 CVEs in the last two years.

How many critical CVEs has XEN published?

XEN has published 14 critical-severity CVEs and 61 high-severity CVEs.

What are the most common weakness types in XEN's CVEs?

XEN's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-667 (Improper Locking), CWE-250 (Execution with Unnecessary Privileges), CWE-787 (Out-of-bounds Write).

How does XEN rank among CNAs?

By total CVE volume, XEN ranks #110 of 370 CNAs, and it reports more complete CVE records than 13% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade F

Active

XEN

Name: XEN CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published January 28, 2026

126

CVEs published

Total assigned

4.8

Years active

2021–2026

N/A

Avg CVSS

Across scored CVEs

24

Recent CVEs

Last 2 years

Overview

XEN is a CVE Numbering Authority that has published 126 CVE records since 2021. It is currently classified as active, with 24 CVEs published in the last two years. Its CVE data quality is graded F (58.5% overall completeness).

Among the 370 CNAs tracked here, XEN ranks #110 by CVE volume and reports more complete records than 13% of all CNAs.

Data quality report card

How complete and consistent XEN's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often XEN also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

F

58.5%

Overall score

Overall completeness58.5%

Vendor completeness100%

Product completeness100%

CVSS completeness0%

CWE completeness34.1%

100%

Update rate

Records revised after publishing

5

Vendor diversity

Distinct vendors covered

742 chars

Avg description length

Per CVE record

2021-04-06

First CVE date

Earliest assignment

2026-01-28

Latest CVE date

Most recent assignment

N/A

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of XEN's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical14

High61

Medium64

Low6

In CISA’s Known Exploited Vulnerabilities catalog

0

None of XEN's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Common weakness types

The CWE weakness categories XEN most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs XEN has published each year.

2021

24

2022

57

2023

9

2024

23

2025

11

2026

21

Top vendors

The vendors XEN publishes the most CVEs for.

Xen Project136 CVEs
debian76 CVEs
fedoraproject66 CVEs
Linux19 CVEs
arm1 CVEs
netapp1 CVEs
Xapi1 CVEs
broadcom1 CVEs

Top products

The products XEN publishes the most CVEs for.

Xen124 CVEs
debian linux76 CVEs
fedora66 CVEs
Linux19 CVEs
linux kernel16 CVEs
XAPI8 CVEs
Xen Hypervisor4 CVEs
Windows PV drivers3 CVEs

Latest CVEs

The most recent CVEs assigned by XEN.

CVE-2026-42486CWE-250
Multiple RBAC issues in XAPI
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2026-23562CWE-250
Multiple RBAC issues in XAPI
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2026-23561CWE-250
Multiple RBAC issues in XAPI
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2026-23560CWE-250
Multiple RBAC issues in XAPI
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2026-23559CWE-250
Multiple RBAC issues in XAPI
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2026-23556CWE-281
oxenstored keeps quota related use counts across domain destruction
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2025-58151CWE-367
varstored: TOCTOU issues with mapped guest memory
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2025-58146CWE-20
XAPI UTF-8 string handling
Critical · CVSS 9.4
EPSS 0.1%2026-07-09
CVE-2025-27464CWE-276
WinPVDrivers: Excessive permissions on user-exposed devices
Critical · CVSS 9.4
EPSS 0.2%2026-07-09
CVE-2025-27463CWE-276
WinPVDrivers: Excessive permissions on user-exposed devices
Critical · CVSS 9.4
EPSS 0.2%2026-07-09
CVE-2025-27462CWE-276
WinPVDrivers: Excessive permissions on user-exposed devices
Critical · CVSS 9.4
EPSS 0.2%2026-07-09
CVE-2026-42488CWE-119
x86: mismatched mapcache metadata
High · CVSS 8.1
EPSS 0.4%2026-06-18

Track new XEN CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor XEN CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the XEN CNA.

What is the XEN CNA?: XEN is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 126 CVE records since 2021.
How many CVEs has XEN published?: XEN has published 126 CVE records, including 24 in the last two years.
What is XEN's CVE data quality grade?: RadicalNotion.AI grades XEN's CVE data quality as F, with an overall completeness score of 58.5%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (0%), and CWE (34.1%) information.
What products does XEN publish CVEs for?: XEN most frequently publishes CVEs for Xen, debian linux, fedora, Linux, linux kernel.
Which vendors does XEN cover?: XEN publishes CVEs across 5 distinct vendors, most often Xen Project, debian, fedoraproject, Linux, arm.
Is XEN actively publishing CVEs?: XEN is currently active, based on 24 CVEs in the last two years.
How many critical CVEs has XEN published?: XEN has published 14 critical-severity CVEs and 61 high-severity CVEs.
Are any of XEN's CVEs in CISA's Known Exploited Vulnerabilities catalog?: No. None of XEN's CVEs are currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
What are the most common weakness types in XEN's CVEs?: XEN's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-667 (Improper Locking), CWE-250 (Execution with Unnecessary Privileges), CWE-787 (Out-of-bounds Write).
How does XEN rank among CNAs?: By total CVE volume, XEN ranks #110 of 370 CNAs, and it reports more complete CVE records than 13% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track XEN CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing