Proxmox VE
Virtualization · products/proxmox-ve.yaml · RSS
Latest 9.2.21 Sep 24, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 9 | 9.2.21 | Sep 24, 2026 |
| 8 | 8.4.21 | Sep 26, 2026 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 9 | 9.2.21 | Aug 5, 2025 | — · maintained |
| 8 | 8.4.21 | Jun 22, 2023 | Aug 31, 2026 · ended |
| 7 | 7.4 | Jul 6, 2021 | Jul 31, 2024 · ended |
| 6 | 6.4 | Jul 16, 2019 | Sep 30, 2022 · ended |
| 5 | 5.4 | Jul 4, 2017 | Jul 31, 2020 · ended |
| 4 | 4.4 | Oct 6, 2015 | Jun 30, 2018 · ended |
| 3 | 3.4 | May 24, 2013 | Feb 28, 2017 · ended |
| 2 | 2.3 | Mar 30, 2012 | May 31, 2014 · ended |
| 1 | 1.9 | Oct 29, 2008 | Jan 31, 2013 · ended |
Recent releases
breakingask for the checks that prove an OSD is gone before its leftover lockbox key is removed, and no longer suggest removing the authentication entry of a daemon that only seems gone
breakingapi: ceph: mds: deprecate hotstandby parameter in the API schema, and do not set the mds_standby_for_name and mds_standby_replay config options any more, they were removed in Ceph 14.1 and setting them has no effect any more
breakingui: qemu: default aarch64 VMs to a KVM-usable CPU model instead of one that QEMU rejects at start, and warn when an incompatible ARM CPU model is selected.
Security advisories
5.4 CVE-2025-57538 A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject m…
5.4 CVE-2025-57539 A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious inpu…
5.4 CVE-2025-57540 A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can in…
8.8 CVE-2023-43320 An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to es…
9.0 CVE-2022-31358 A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under…
7.1 CVE-2022-35507 A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser t…
9.8 CVE-2022-35508 Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged accoun…
Sources
- apt http://download.proxmox.com/debian/pve/dists/trixie/pve-no-subscription/binary-amd64/Packages
- apt http://download.proxmox.com/debian/pve/dists/bookworm/pve-no-subscription/binary-amd64/Packages
- html https://pve.proxmox.com/wiki/Roadmap
- debian-changelog https://git.proxmox.com/?p=pve-manager.git;a=blob_plain;f=debian/changelog;hb=HEAD
- nvd https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aproxmox%3Avirtual_environment
- endoflife https://endoflife.date/proxmox-ve