Even Xen (VM used by Qubes) periodically has CVEs, although they don’t always affect Qubes due to additional layers of defense and/or limited hardware targets.