Virtualization

WebVirtCloud suffers from a privilege escalation vulnerability (CVE-2026-92761) where the get_instance gate fails to validate permission flags, enabling read-only users to perform administrative actions.

A vulnerability in libtpms (CVE-2024-0230) allows an attacker on an adjacent network to trigger a denial of service condition, potentially leading to service instability.

A vulnerability in the libvirt virtualization API allows a remote attacker on an adjacent network to trigger a denial-of-service condition affecting the virtualization host.

VMware has released security updates for Fusion and Workstation to address multiple vulnerabilities, including CVE-2026-59346 and CVE-2026-59347, which could allow a remote attacker to execute arbitrary code.

An arbitrary user within a QEMU-based Lima VM can exploit improper access controls on the guest agent Unix socket (/run/lima-guestagent.sock) to execute arbitrary commands with root privileges within the guest VM.

A vulnerability in QEMU allows a remote, authenticated attacker to trigger memory corruption or a denial-of-service condition, impacting system availability.

A vulnerability in the Linux kernel KVM module allows a guest user to trigger memory corruption via improper shadow VMCS handling after a VMCLEAR operation.

CVE-2026-64561 identifies a flaw in the Linux KVM hypervisor where incorrect validation of MMU pages could lead to memory management inconsistencies.

Multiple critical vulnerabilities, including CVE-2026-59309 and CVE-2026-59310 with CVSS 9.8, affect VMware vCenter and ESX/ESXi products, enabling unauthorized access without credentials, arbitrary code execution, virtualization escape, information disclosure, and defense evasion, which could lead to full system compromise and data breaches.

Multiple vulnerabilities have been discovered in Xen, allowing an attacker to achieve privilege escalation, remote denial of service, and compromise data confidentiality across all unpatched Xen versions, necessitating immediate patching.

Multiple unspecified vulnerabilities in the Xen hypervisor allow an attacker to escalate privileges, disclose confidential information, or cause a denial-of-service condition affecting virtualized environments.

Multiple vulnerabilities exist in VMware Cloud Foundation, vSphere, Aria Operations, and VMware Tools, allowing an attacker to exploit these weaknesses to gain elevated privileges, including administrative access, and disclose confidential information within affected environments.

A critical vulnerability, CVE-2026-3842, exists in the `hyperv/syndbg` component of Qemu-kvm, allowing an attacker to perform out-of-bounds writes on the host system due to a missing mapped-length guard after a `cpu_physical_memory_map` operation.

A denial-of-service vulnerability (CVE-2026-63806) has been identified in KVM's ioeventfd datamatch handling, allowing a guest virtual machine to trigger a BUG_ON() condition on the host, leading to a system crash.

A local attacker can exploit a vulnerability in QEMU to elevate their privileges and execute arbitrary code on the host system where QEMU is running.

Multiple vulnerabilities exist in QEMU and libvirt, which can be exploited by a local attacker to disclose sensitive information and bypass security mechanisms, potentially leading to privilege escalation.

CVE-2026-53359 is a high-severity use-after-free vulnerability affecting the KVM virtualization component on x86 architectures within the Linux kernel, stemming from an unexpected role in shadow paging, which could lead to host system compromise.

Multiple vulnerabilities, including CVE-2025-10263, CVE-2026-42487, CVE-2026-42488, CVE-2026-42489, and CVE-2026-42490, have been discovered in Xen, allowing an attacker to achieve privilege escalation, trigger a remote denial of service, and compromise data confidentiality on vulnerable hypervisor instances.

Citrix released security advisory AV26-400 on April 28, 2026, addressing vulnerabilities in XenServer versions prior to 8.4, prompting users to apply mitigations.

The BRICKSTORM malware targets VMware vSphere environments, specifically vCenter Server Appliance (VCSA) and ESXi hypervisors, by exploiting weak security configurations to establish persistence at the virtualization layer, leading to administrative control and potential data exfiltration.

An unpatched vulnerability in QEMU's virtio-snd component allows for a hypervisor escape due to an uncontrolled heap overflow.

The Intel EPT paging code vulnerability (CVE-2026-23554) allows access to unintended memory regions due to improper handling of cached EPT state during paging structure freeing.

SUSE Harvester's Rancher integration mechanism is vulnerable to a man-in-the-middle attack due to insecure TLS options, potentially leading to denial of service.

Detects the execution of QEMU with the -nographic flag and an image file on Windows systems, a technique used for persistence and initial access by installing a rogue Linux virtual machine.