CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

EUVD-2026-105088

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610

Xen Orchestra versions prior to 6.9.0 are vulnerable to an authorization bypass within the xo-server user.set API method. This flaw allows low-privileged authenticated users to modify the preferences of other users by providing an arbitrary target user ID. Consequences include the ability to dele...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

PT-2026-118470

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: fix PCI-E clock oops Fix PCI-E clock-related kernel oops caused by a missing clock parent. pcie0rchngclksrc has numparents set to 2 but only one parent is actually set via parenthws; it should also define “XO”...

Malicious Package

Overview lint-xo-ceres-mini-css-extract-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious code in lint-xo-ceres-mini-css-extract-plugin (npm)

Source: amazon-inspector daa7e2a9508eacc4043acfb139a17de0eaa316004f37d0113aea6b9de678ee44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-staged-sirius-xo-juno (npm)

Source: amazon-inspector 6e17f64d7f2c40a23b7372bb25ea8330f1abf134122c1dbca12aa0be572e7394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kinetic-xo-tool-polaris (npm)

The package kinetic-xo-tool-polaris was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ini-dactyl-xo-perseus (npm)

The package ini-dactyl-xo-perseus was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ini-middleware-build-xo (npm)

Source: amazon-inspector 2246fe3ca33b8fcca8464aa54b16b62c8bb88ab3d1ac8125772343cdea2de33b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inflation-weywot-comet-xo (npm)

Source: amazon-inspector 2494101eede652b8876724d3d4c467b0a2d07002f73e58557044c083908f9847 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ignite-rehype-xo-cypress (npm)

Source: amazon-inspector d4a51f0740e1612c51322e453536c8292d2bc79861076bc5c2b152821856564f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hexo-publish-hexo-xo (npm)

Source: amazon-inspector d00717e5974b423da54268e70eeedbebfd4bb4bf7ee91f3dd7e0b29ca6d88211 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in helmet-neutronstar-xo-xerxes (npm)

Source: amazon-inspector 581f8b3bbe8d1d6d256b170ebe95f9b25932b9f70d22809d6886514f5a2936a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hapi-antd-dione-xo (npm)

Source: amazon-inspector 75ba1fa7ad9b95e2d278e65f7fd0570ddd801f915a2455530317272b4893438e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gravitationalwave-corvus-dotenv-parse-variables-xo (npm)

The package gravitationalwave-corvus-dotenv-parse-variables-xo was found to contain malicious code. --- Credit: OpenSSF source...