Anyone who has access to your xPub can see all the addresses associated with your wallet, and therefore all transactions associated with those addresses. Although the xPub is nowhere near as sensitive as your seed phrase, since it does not allow balances to be spent, you should still be careful not to share it with people that you do not want to know the digital asset transaction history for the associated wallet.