Security News

Security

2026-11-03 XSAs released on 2026-11-03
2026-11-03 QSB-121: Arbitrary read/write via grant copy (XSA-523)
2026-10-13 XSAs released on 2026-10-13
2026-10-09 XSAs released on 2026-10-09
2026-10-08 QSB-120: Two CTAP proxy vulnerabilities
2026-09-15 QSB-119: Potential attacker-controlled format string in qvm-open-in-vm
2026-09-09 Qubes Canary 048
2026-09-08 XSAs released on 2026-09-08
2026-08-29 QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting
2026-08-28 QSB-117: Intel CPU firmware vulnerabilities
2026-07-28 XSAs released on 2026-07-28
2026-07-28 QSB-116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507)
2026-07-14 XSAs released on 2026-07-14
2026-06-09 XSAs released on 2026-06-09
2026-06-09 QSB-115: HVM I/O port list traversal (XSA-491)
2026-06-03 Qubes Canary 047
2026-05-14 QSB-114: Intel CPU data exposure vulnerability
2026-05-13 XSAs released on 2026-05-12
2026-05-13 QSB-113: AMD CPU Opcode Cache corruption (XSA-490)
2026-04-28 XSAs released on 2026-04-28
2026-04-19 XSAs released on 2026-04-17
2026-04-19 QSB-112: Floating Point Divider State Sampling (XSA-488)
2026-04-15 QSB-111: xfce4-screensaver login bypass
2026-03-24 XSAs released on 2026-03-24
2026-03-17 XSAs released on 2026-03-17
2026-03-17 QSB-110: Use after free of paging structures in EPT (XSA-480)
2026-03-13 Qubes Canary 046
2026-01-27 XSAs released on 2026-01-27
2025-12-10 Qubes Canary 045
2025-10-24 XSAs released on 2025-10-24
2025-10-21 XSAs released on 2025-10-21
2025-09-09 XSAs released on 2025-09-09
2025-09-02 Qubes Canary 044
2025-08-14 QSB-109: Intel microcode updates
2025-07-11 XSAs released on 2025-07-08
2025-07-11 QSB-108: Transitive Scheduler Attacks (XSA-471)
2025-07-01 XSAs released on 2025-07-01
2025-06-04 Qubes Canary 043
2025-05-27 XSAs released on 2025-05-27
2025-05-15 XSAs released on 2025-05-12
2025-05-15 QSB-107: Multiple CPU branch prediction vulnerabilities
2025-03-08 Qubes Canary 042
2025-02-27 XSAs released on 2025-02-27
2024-12-18 XSAs released on 2024-12-17
2024-12-03 Qubes Canary 041
2024-11-29 XSAs released on 2024-11-12
2024-11-12 QSB-106: Information disclosure through uninitialized memory in libxl
2024-10-17 QSB-105: Missing enforced decorations for stubdomain windows under KDE
2024-09-24 XSAs released on 2024-09-24
2024-09-07 Qubes Canary 040
2024-08-14 XSAs released on 2024-08-13
2024-07-30 QSB-104: GUI-related security bugs
2024-07-16 XSAs released on 2024-07-16
2024-07-16 QSB-103: Double unlock in x86 guest IRQ handling (XSA-458)
2024-06-14 Qubes Canary 039
2024-05-08 XSAs released on 2024-05-07
2024-04-10 XSAs released on 2024-04-09
2024-04-10 QSB-102: Multiple speculative-execution vulnerabilities: Spectre-BHB, BTC/SRSO (XSA-455, XSA-456)
2024-03-18 Update for QSB-101: Register File Data Sampling (XSA-452) and Intel Processor Return Predictions Advisory (INTEL-SA-00982)
2024-03-13 XSAs released on 2024-03-12
2024-03-13 QSB-101: Register File Data Sampling (XSA-452)
2024-03-11 Qubes Canary 038
2024-02-27 XSAs released on 2024-02-27
2024-02-05 XSAs released on 2024-01-30
2024-02-05 XSAs released on 2024-01-22
2024-01-30 QSB-100: Incorrect handling of PCI devices with phantom functions (XSA-449)
2024-01-19 QSB-099: Qrexec policy leak via policy.RegisterArgument service
2023-12-15 QSB-098: CPU microcode updates not loaded with dom0 kernel version 6.6.x
2023-12-12 XSAs released on 2023-12-12
2023-12-11 Qubes Canary 037
2023-11-15 QSB-097: "Reptar" Intel redundant prefix vulnerability
2023-11-14 XSAs released on 2023-11-14
2023-11-14 QSB-096: BTC/SRSO fixes not fully effective (XSA-446)
2023-10-10 XSAs released on 2023-10-10
2023-10-10 QSB-095: Missing IOMMU TLB flushing on x86 AMD systems
2023-09-27 XSAs released on 2023-09-25
2023-09-27 QSB-094: x86/AMD: Divide speculative information leak
2023-09-20 XSAs released on 2023-09-20
2023-09-12 Qubes Canary 036
2023-09-05 XSAs released on 2023-09-05
2023-08-09 XSAs released on 2023-08-08
2023-08-09 QSB-093: Transient execution vulnerabilities in AMD and Intel CPUs (CVE-2023-20569/XSA-434, CVE-2022-40982/XSA-435)
2023-08-08 QSB-092: Buffer overrun in Linux netback driver (XSA-432)
2023-08-02 Update for QSB-090: Zenbleed (CVE-2023-20593, XSA-433)
2023-08-01 XSAs released on 2023-08-01
2023-07-27 QSB-091: Windows PV drivers potentially compromised
2023-07-24 XSAs released on 2023-07-24
2023-07-24 QSB-090: Zenbleed (CVE-2023-20593, XSA-433)
2023-05-22 Qubes Canary 035
2023-05-16 XSAs released on 2023-05-16
2023-05-11 QSB-089: Qrexec: Memory corruption in service request handling
2023-04-25 XSAs released on 2023-04-25
2023-03-21 XSAs released on 2023-03-21
2023-03-21 QSB-088: Two Xen issues affecting PV (stub-)domains (XSA-428, XSA-429)
2023-03-02 Qubes Canary 034
2023-02-15 XSAs released on 2023-02-14
2023-01-27 XSAs released on 2023-01-25
2022-12-06 XSAs released on 2022-12-06
2022-12-04 Qubes Canary 033
2022-11-23 QSB-087: Qrexec: Injection of unsanitized data into log output
2022-11-08 XSAs released on 2022-11-08
2022-11-08 QSB-086: Speculative security issues on AMD CPUs (XSA-422)
2022-11-01 XSAs released on 2022-11-01
2022-11-01 QSB-085: Xenstore: Guests can crash xenstored (XSA-414)
2022-10-11 XSAs released on 2022-10-11
2022-09-14 Qubes Canary 032
2022-08-06 QSB-084: Split GPG: GnuPG file descriptor confusion and file existence leak
2022-07-26 XSAs released on 2022-07-26
2022-07-13 XSAs released on 2022-07-12
2022-07-13 QSB-083: Retbleed: Arbitrary speculative code execution with return instructions (XSA-407)
2022-07-05 XSAs released on 2022-07-05
2022-07-05 QSB-082: Memory management issues in PV frontend drivers
2022-06-17 XSAs released on 2022-06-14
2022-06-17 QSB-081: x86: MMIO Stale Data vulnerabilities (XSA-404)
2022-06-12 Qubes Canary 031
2022-06-09 XSAs released on 2022-06-09
2022-06-09 QSB-080: Issues with PV domains and PCI passthrough (XSA-401, XSA-402)
2022-04-05 XSAs released on 2022-04-05
2022-04-05 QSB-079: Two IOMMU-related Xen issues (XSA-399, XSA-400)
2022-03-10 XSAs released on 2022-03-10
2022-03-10 XSAs released on 2022-03-08
2022-03-10 QSB-078: Linux kernel PV driver issues and LVM misconfiguration
2022-03-10 QSB-077: Multiple speculative security issues (XSA-398)
2022-03-08 Qubes Canary 030
2022-02-11 QSB-076: Intel microcode updates
2022-01-25 XSAs released on 2022-01-25
2022-01-25 QSB-075: Insufficient cleanup of passed-through device IRQs (XSA-395)
2021-12-20 XSAs released on 2021-12-20
2021-12-13 Qubes Canary 029
2021-11-24 XSAs released on 2021-11-23
2021-11-24 QSB-074: Xen issues related to populate-on-demand (XSA-388, XSA-389)
2021-11-19 XSAs released on 2021-11-19
2021-10-15 QSB-073: Race condition when setting override-redirect flag
2021-10-07 XSAs released on 2021-10-05
2021-09-27 QSB-072: Inconsistent handling of the override-redirect flag
2021-09-09 QSB-071: Fatal options filtering flaw in Split GPG
2021-09-08 XSAs released on 2021-09-08
2021-08-31 Qubes Canary 028
2021-08-25 XSAs released on 2021-08-25
2021-08-25 QSB-070: Xen issues related to grant tables v2 and IOMMU
2021-06-14 Qubes Canary 027
2021-06-08 XSAs released on 2021-06-08
2021-06-08 QSB-069: Multiple Xen and Intel issues
2021-06-04 QSB-068: Disconnecting a video output can cause XScreenSaver to crash
2021-05-04 XSAs released on 2021-05-04
2021-03-30 XSAs released on 2021-03-30
2021-03-19 QSB-067: Multiple RPM vulnerabilities
2021-03-18 XSAs released on 2021-03-18
2021-03-11 Qubes Canary 026
2021-03-04 XSAs released on 2021-03-04
2021-03-03 QSB-066: XML injection through libvirt domain configuration
2021-02-19 XSAs released on 2021-02-18
2021-02-19 QSB-065: Missed flush in XSA-321 backport (XSA-366)
2021-02-17 XSAs released on 2021-02-16
2021-02-17 QSB-064: Linux: error handling issues in blkback's grant mapping (XSA-365)
2021-01-22 XSAs released on 2021-01-21
2020-12-16 XSAs released on 2020-12-15
2020-12-16 QSB-063: Multiple Xen issues (XSA-115, XSA-325, XSA-350)
2020-12-12 Qubes Canary 025
2020-11-24 QSB #062: Stack corruption from XSA-346 change (XSA-355)
2020-11-10 QSB #061: Information leak via power sidechannel (XSA-351)
2020-10-20 XSAs 286, 331, 332, and 345 do not affect the security of Qubes OS
2020-10-20 QSB #060: Multiple Xen issues (XSA-345, XSA-346, XSA-347)
2020-09-22 XSAs 333, 334, 336, 338, 339, 342, and 344 do not affect the security of Qubes OS
2020-09-22 QSB #059: Multiple Xen issues (XSA-337, XSA-340, XSA-343)
2020-09-10 Qubes Canary #24
2020-08-24 XSA-335 does not affect the security of Qubes OS
2020-07-16 XSA-329 does not affect the security of Qubes OS
2020-07-07 XSAs 317, 319, 327, and 328 do not affect the security of Qubes OS
2020-07-07 QSB #058: Insufficient cache write-back under VT-d (XSA-321)
2020-06-11 QSB #057: Special Register Buffer speculative side channel (XSA-320)
2020-04-15 XSAs 313, 314, 316, and 318 do not affect the security of Qubes OS
2020-04-15 Qubes Canary #23
2020-03-12 XSA-315 does not affect the security of Qubes OS
2020-01-15 XSA-312 does not affect the security of Qubes OS
2020-01-15 Qubes Canary #22
2019-12-25 QSB #056: Insufficient anti-spoofing firewall rules
2019-12-11 XSAs 307, 308, and 309 do not affect the security of Qubes OS
2019-12-11 QSB #055: Issues with PV type change and handling IOMMU on AMD (XSA-310, XSA-311)
2019-11-26 QSB #054: Xen fix for XSA-302 found ineffective in Qubes configuration (XSA-306)
2019-11-13 XSA-304 does not affect the security of Qubes OS
2019-11-13 QSB #053: TSX Asynchronous Abort speculative side channel (XSA-305)
2019-10-31 XSAs 296, 298, 301, and 303 do not affect the security of Qubes OS
2019-10-31 QSB #052: Xen issues affecting PCI passthrough and PV domains (XSA-299, XSA-302)
2019-10-13 Qubes Canary #21
2019-09-10 QSB #051: Insufficient validation of backup compression filter on restore
2019-07-24 QSB #050: Reinstalling a TemplateVM does not reset the private volume
2019-07-09 XSA-300 does not affect the security of Qubes OS
2019-07-04 Qubes Canary #20
2019-06-13 XSA-295 does not affect the security of Qubes OS
2019-05-15 QSB #049: Microarchitectural Data Sampling speculative side channel (XSA-297)
2019-04-08 Qubes Canary #19
2019-03-05 XSAs 284, 290, 291, 293, and 294 do not affect the security of Qubes OS
2019-03-05 QSB #048: Multiple Xen vulnerabilities
2019-02-19 QSB #47: Insecure default DisposableVM networking configuration
2019-01-23 QSB #46: APT update mechanism vulnerability
2019-01-21 XSA-289 does not affect the security of Qubes OS
2019-01-08 Qubes Canary #18
2018-12-03 QSB #45: Insecure default Salt configuration
2018-11-20 XSA-276, XSA-277, and XSA-279 do not affect the security of Qubes OS
2018-11-20 QSB #44: Multiple Xen vulnerabilities (XSA-275, XSA-280)
2018-11-06 XSA-282 does not affect the security of Qubes OS
2018-11-05 Qubes Security Team Update
2018-10-24 XSA-278 does not affect the security of Qubes OS
2018-10-15 Qubes Canary #17
2018-09-11 Introducing the Qubes U2F Proxy
2018-09-02 QSB #43: L1 Terminal Fault speculative side channel (XSA-273)
2018-08-14 XSA-268, XSA-269, XSA-271, and XSA-272 do not affect the security of Qubes OS
2018-08-14 QSB #42: Linux netback driver OOB access in hash handling (XSA-270)
2018-07-25 XSA-274 does not affect the security of Qubes OS
2018-06-27 XSA-264, XSA-265, and XSA-266 do not affect the security of Qubes OS
2018-06-14 Qubes Canary #16
2018-06-13 QSB #41: Speculative register leakage from lazy FPU context switching (XSA-267)
2018-06-13 Update for QSB #40: Information leaks due to processor speculative store bypass (XSA-263)
2018-05-24 QSB #40: Information leaks due to processor speculative store bypass (XSA-263)
2018-05-08 QSB #39: Xen vulnerability (XSA-260) and GUI daemon issue
2018-04-25 XSA-258 and XSA-259 do not affect the security of Qubes OS
2018-03-15 Update for QSB #37: Information leaks due to processor speculative execution bugs (XSA-254, Meltdown & Spectre)
2018-03-15 Qubes Canary #15
2018-02-27 XSA-252, XSA-255, and XSA-256 do not affect the security of Qubes OS
2018-02-20 QSB #38: Qrexec policy bypass and possible information leak
2018-01-24 Update for QSB #37: Information leaks due to processor speculative execution bugs (XSA-254, Meltdown & Spectre)
2018-01-11 QSB #37: Information leaks due to processor speculative execution bugs (XSA-254, Meltdown & Spectre)
2018-01-04 Announcement regarding XSA-254 (Meltdown and Spectre attacks)
2018-01-04 XSA-253 does not affect the security of Qubes OS
2017-12-12 XSA-248 through XSA-251 do not affect the security of Qubes OS
2017-12-11 Qubes Canary #14
2017-11-28 QSB #36: Xen hypervisor issue in populate-on-demand code (XSA-247)
2017-10-25 QSB #35: Xen hypervisor issue related to grant tables (XSA-236)
2017-10-18 MSI support for PCI device pass-through with stub domains
2017-10-12 QSB #34: GUI issue and Xen vulnerabilities (XSA-237 through XSA-244)
2017-10-03 Introducing the Next Generation Qubes Core Stack
2017-09-28 XSA-245 does not affect the security of Qubes OS
2017-09-12 QSB #33: Xen hypervisor (XSA-231 through XSA-234)
2017-09-12 Qubes Canary #13
2017-08-23 XSA-235 does not affect the security of Qubes OS
2017-08-15 QSB #32: Xen hypervisor and Linux kernel vulnerabilities (XSA-226 through XSA-230)
2017-06-27 Introducing the Qubes Admin API
2017-06-20 QSB #31: Xen hypervisor vulnerabilities with unresearched impact (XSA 216-224)
2017-06-05 Qubes Canary #12
2017-05-02 QSB #30: Critical Xen bugs related to PV memory virtualization (XSA-213, XSA-214)
2017-04-26 Compromise recovery in Qubes OS
2017-04-04 QSB #29: Critical Xen bug in PV memory virtualization code (XSA-212)
2017-03-28 XSA-206 does not affect the security of Qubes OS
2017-03-07 Qubes Canary #11
2016-12-19 Qubes Security Bulletin (QSB) #28: Debian update mechanism vulnerability
2016-12-13 Qubes Canary #10
2016-11-22 Qubes Security Bulletin #27: Xen 64-bit bit test instruction emulation broken (XSA 195)
2016-05-30 Security challenges for the Qubes build process
2012-11-16 Qubes Security Team has joined the Xen Security Pre-disclousre list