https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-94588.htmlhttps://patchthecve.com/cve/CVE-2026-94588.htmlThu, 24 Sep 2026 21:18:58 +0000MEDIUM 4.4: In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a https://patchthecve.com/cve/CVE-2023-54391.htmlhttps://patchthecve.com/cve/CVE-2023-54391.htmlTue, 08 Sep 2026 20:18:59 +0000CRITICAL 9.8: Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ihttps://patchthecve.com/cve/CVE-2026-45694.htmlhttps://patchthecve.com/cve/CVE-2026-45694.htmlWed, 09 Sep 2026 21:09:13 +0000MEDIUM 5.4: LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters https://patchthecve.com/cve/CVE-2026-51083.htmlhttps://patchthecve.com/cve/CVE-2026-51083.htmlFri, 17 Jul 2026 18:29:27 +0000MEDIUM 6.5: Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.https://patchthecve.com/cve/CVE-2026-51082.htmlhttps://patchthecve.com/cve/CVE-2026-51082.htmlFri, 17 Jul 2026 18:28:39 +0000HIGH 7.2: A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with prihttps://patchthecve.com/cve/CVE-2026-51081.htmlhttps://patchthecve.com/cve/CVE-2026-51081.htmlFri, 17 Jul 2026 18:29:27 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.https://patchthecve.com/cve/CVE-2026-51080.htmlhttps://patchthecve.com/cve/CVE-2026-51080.htmlTue, 11 Aug 2026 23:41:07 +0000CRITICAL 9.8: libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.https://patchthecve.com/cve/CVE-2026-25199.htmlhttps://patchthecve.com/cve/CVE-2026-25199.htmlMon, 26 Oct 2026 19:10:00 +0000CRITICAL 9.1: Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associ