213 matches found
CVE-2026-PSA-2026-00043-1
PSA-2026-00043-1 CVE-2026-PSA-2026-00043-1 Proxmox VE 7.0–8.0.3: unauthenticated, single-request root auth bypass Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក...
CVE-2024-21545-PoC
CVE-2024-21545-PoC Proxmox VE Arbitrary File Read - Full System Compromise . Not Testeted yet... will test them this week...
List of Security Fixes and Improvements in Veeam Plug-in for Proxmox VE
Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for Proxmox VE. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...
Proxmox VE - Default Credentials with TFA Bypass
Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password "root@pam" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement an...
EUVD-2023-60613
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
CVE-2023-54391
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains a critical authentication bypass in libpve-access-control before 8.0.4 . By supplying an arbitrary value in the tfa-challenge parameter of the access ticket API endpoint, unauthenticated attackers can skip password verification entirely an...
CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
VulnCheck KEV: CVE-2023-54391
Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...
PT-2026-84529
Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...
Proxmox VE Worker VM Deployment Fails When Default Local Storage Is Disabled
Challenge When attempting to deploy or test a worker VM, the operation fails with the following errors: Failed to deploy the worker VM: Cannot access a closed Stream. Worker test failed: Cannot access a closed Stream. This may also occur after an upgrade, when the existing worker VM is recreated...
CVE-2026-51081
A cross-site scripting (XSS) vulnerability exists in Proxmox Virtual Environment (PVE) . The issue affects versions 9.x 5.1.8 and 8.x 4.3.16 , where an attacker can inject a crafted payload to execute arbitrary web scripts or HTML. No specific technical root cause, exploit links, or remediation d...
CVE-2026-51082
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...
CVE-2026-51082
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...
Malicious code in ve-hemi-rewards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8252216c6621e6391775d34f5e32815ab8c2a830df080fed52113b4cf855aa1 On npm install, the package's preinstall lifecycle invokes postinstall.js, which collects hostname, username, and current working directory, then...
MAL-2026-5785 Malicious code in ve-hemi-rewards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8252216c6621e6391775d34f5e32815ab8c2a830df080fed52113b4cf855aa1 On npm install, the package's preinstall lifecycle invokes postinstall.js, which collects hostname, username, and current working directory, then...
CVE-2026-40618
When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition VE without Intel QuickAssist Technology QAT or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel TMM to...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: x86/tdx: Panics occur in cases of incorrect configurations involving access to “private” memory, resulting in a VE exception. All normal kernel memory is considered “TDX private memory”. This includes everything, from kernel...
PT-2026-40650
Name of the Vulnerable Software and Affected Versions BIG-IP Virtual Edition VE affected versions not specified BIG-IP hardware platforms affected versions not specified Description Undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate when an SSL profile is configured...
