Proxmox security advisories
Every advisory Proxmox has published in the forum, with packages, fixed versions and CVSS scores.
- "Crackarmor" apparmor vulnerabilities
proxmox-kernel-*
–No score - Log poisoning via crafted HTTP Forwarded header
proxmox-backup-server
–No score - User Enumeration Vulnerability in Proxmox Backup Server API Token Authentication
proxmox-backup-server
–No score - Bypass of mail filters through confusion of the MIME Parser
pmg-api, libmime-tools-perl
–No score - Authenticated Remote Code Execution via shell injection
proxmox-datacenter-manager
–No score - –No score
- Authenticated Remote Code Execution via shell injection
proxmox-backup-server
–No score - Missing protections against malicious backup clients with S3-backed datastores
proxmox-backup-server
–No score - Race condition during long-running garbage collection and pruning of recent snapshots may lead to back up corruption before Proxmox Backup Server 3.4
proxmox-backup-server
–No score - Spectre branch target injection from VM guests ("VMScape")
proxmox-kernel-6.8, proxmox-kernel-6.14
CVE-2025-40300
5.5Medium - stored XSS in config values
pmg-gui
–No score - stored XSS in config values
proxmox-backup-server
–No score - Incomplete exclusion of the NTFS module in Grub2 with Secure Boot
grub-efi-amd64-signed 1+2.06+13+pmx6
–No score - Various SecureBoot bypasses, data integrity violations and sensitive data leaks in Grub
grub-pc-bin, grub-efi-amd64-bin, grub-efi-amd64-signed, grub-efi-amd64-unsigned
CVE-2024-45774, CVE-2024-45775, CVE-2024-45776, CVE-2024-45777, CVE-2024-45778,…
7.8High - XSS in mail queue fields
pmg-gui
–No score - –No score
- Proxmox Backup Server: unauthenticated DOS vulnerability
proxmox-backup-server (== 3.2.8-1, pbstest and pbs-no-subscription only)
–No score - Proxmox VE/Mail Gateway API: post-authentication privileged file read vulnerabilities
- Proxmox Virtual Environment: pve-manager, libpve-storage-perl, libpve-http-server-perl, qemu-server - Proxmox Mail Ga…
CVE-2024-21545
8.2High - Shim bootloader remote code execution via http response
shim-unsigned, shim-signed
CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40551
8.3High - 5.3Medium
- Tape backup drive encryption failure
proxmox-backup-server
–No score