Three XSA are currently under embargo at https://xenbits.xen.org/xsa/
XSA-262 - Prereleased, but embargoed
XSA-261 - Prereleased, but embargoed
XSA-260 - Prereleased, but embargoed
Could be related to Spectre-NG
https://www.heise.de/ct/artikel/Exclusive-Spectre-NG-Multiple-new-Intel-CPU-flaws-revealed-several-serious-4040648.html
XSA 260 disclosed. "A malicious PV guest can escalate their privilege to that of the hypervisor." https://xenbits.xen.org/xsa/advisory-260.html