Proxmox
Proxmox Virtual Environment: vulnerabilidades y CVE
Proxmox Virtual Environment tiene 13 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses4
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-54391 | Crítica (9.3) | 3.2% | — | 1 sept 2026 | Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user… |
| CVE-2026-51083 | Media (6.5) | 0.34% | — | 17 jul 2026 | Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API. |
| CVE-2026-51082 | Alta (7.2) | 0.39% | — | 17 jul 2026 | A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and… |
| CVE-2026-51081 | Media (6.1) | 0.25% | — | 17 jul 2026 | A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a… |
| CVE-2025-57540 | Media (5.4) | 0.29% | — | 9 sept 2025 | A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code… |
| CVE-2025-57539 | Media (5.4) | 0.29% | — | 9 sept 2025 | A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is… |
| CVE-2025-57538 | Media (5.4) | 0.34% | — | 9 sept 2025 | A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The… |
| CVE-2024-21545 | Alta (8.2) | 0.36% | — | 25 sept 2024 | Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or… |
| CVE-2023-43320 | Alta (8.8) | 1.4% | — | 27 sept 2023 | An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via… |
| CVE-2022-31358 | Crítica (9) | 1.3% | — | 14 dic 2022 | A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/. |
| CVE-2022-35508 | Crítica (9.8) | 1.2% | — | 4 dic 2022 | Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP… |
| CVE-2022-35507 | Alta (7.1) | 1.4% | — | 4 dic 2022 | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than… |
| CVE-2014-4156 | Media (5.3) | 1.2% | — | 27 ene 2020 | Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.