CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/05/2026 |
| CVE-2026-44883 | HIGH7.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed as the ?token=<JWT> UR | 28/05/2026 |
| CVE-2026-44882 | HIGH8.1 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates | 28/05/2026 |
| CVE-2026-44881 | CRITICAL9.9 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git repositories. When a Git-backed stack is created | 28/05/2026 |
| CVE-2026-44850 | HIGH8.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for non-administrators security set | 28/05/2026 |
| CVE-2026-44849 | HIGH8.8 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure | 28/05/2026 |
| CVE-2026-44848 | HIGH8.8 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints (/plugins/*) were not registered with a handler, so st | 28/05/2026 |
| CVE-2024-33662 | HIGH7.5 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. | 02/10/2024 |
| CVE-2024-33661 | CRITICAL9.1 | Portainer before 2.20.0 allows redirects when the target is not index.yaml. | 26/04/2024 |
| CVE-2024-29296 | MEDIUM5.3 | A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. | 10/04/2024 |
| CVE-2022-24961 | CRITICAL9.8 | In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. | 11/02/2022 |
| CVE-2021-42650 | MEDIUM6.1 | Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates. | 18/10/2021 |
| CVE-2020-24264 | CRITICAL9.8 | Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be l | 16/03/2021 |
| CVE-2020-24263 | HIGH8.8 | Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host. | 16/03/2021 |
| CVE-2019-16878 | MEDIUM5.4 | Portainer before 1.22.1 has XSS (issue 2 of 2). | 07/11/2019 |
| CVE-2019-16877 | HIGH8.8 | Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4). | 07/11/2019 |
| CVE-2019-16876 | HIGH7.5 | Portainer before 1.22.1 allows Directory Traversal. | 07/11/2019 |
| CVE-2019-16872 | CRITICAL9.9 | Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). | 07/11/2019 |