Proxmox Virtual Environment (VE) Vulnerabilities & Security Advisories
13 advisories tracked · Proxmox Security Advisories + NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Proxmox advisory that VulniPulse classified as Virtual Environment (VE), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 3 critical, 4 high, 6 medium.
Android app · Google Play
Monitor Proxmox CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Proxmox Security Advisories + NVD
Proxmox posts security advisories on its forum (no machine-readable feed) and its CVEs are assigned by MITRE / researchers rather than a Proxmox CNA — so VulniPulse ingests them from NVD (keyword-filtered to Proxmox, dropped unless a Proxmox product is named). Covers Proxmox Virtual Environment (VE), Proxmox Backup Server (PBS) and Proxmox Mail Gateway (PMG) — the homelab and SMB virtualization stack, complementing VMware/Omnissa coverage.
Latest Proxmox Virtual Environment (VE) advisories
Medium [CVE-2026-51083] Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.
Medium [CVE-2026-51081] cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Medium [CVE-2025-57540] Proxmox Virtual Environment: stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration…
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.
Medium [CVE-2025-57539] Proxmox Virtual Environment: stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual…
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.
Medium [CVE-2025-57538] Proxmox Virtual Environment: stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox…
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.
Medium [CVE-2014-4156] Proxmox VE: Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability
Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability