It seems like there's a new XSA every month. Amazon have rolling EC2 blackouts whenever they have to update Xen for a critical security issue. Linode moved from Xen to KVM partially for the security benefits.
But, i don't know of any XSA-alike reporting system for KVM. Maybe KVM just gets less security attention since it's not yet the #1 market player. Certainly many qemu vulnerabilities impact both Xen and KVM.
My question is:
Does Xen's greater rate of disclosed vulnerabilities indicate less secure code than KVM, or, does it only indicate greater scrutiny?