Filtered by vendor Proxmox
Subscriptions
Filtered by product Proxmox
Subscriptions
Total
3 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16658 | 1 Proxmox | 1 Proxmox | 2026-09-02 | 9.9 Critical |
| A flaw was found in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin. The _build_pct_command() method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command (such as >, |, ;, &&, or $()) are interpreted on the host instead of inside the target LXC container, allowing commands intended for an unprivileged container to execute on the hypervisor host as root. This constitutes a container-to-host trust boundary crossing. The put_file and fetch_file methods in the same plugin correctly use shell quoting, indicating this is an oversight on the exec path. | ||||
| CVE-2026-51083 | 1 Proxmox | 1 Proxmox | 2026-08-01 | 6.5 Medium |
| Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API. | ||||
| CVE-2025-57539 | 1 Proxmox | 2 Proxmox, Virtual Environment | 2025-09-18 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks. | ||||
Page 1 of 1.