| CVE-2026-55761 | 보통5.9 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and | 08/07/2026 |
| CVE-2026-44885 | 보통5.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. | 28/05/2026 |
| CVE-2026-44884 | 보통6.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/ | 28/05/2026 |
| CVE-2026-44883 | 높음7.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed as the ?token=<JWT> UR | 28/05/2026 |
| CVE-2026-44882 | 높음8.1 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates | 28/05/2026 |
| CVE-2026-44881 | 심각9.9 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git repositories. When a Git-backed stack is created | 28/05/2026 |
| CVE-2026-44850 | 높음8.5 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for non-administrators security set | 28/05/2026 |
| CVE-2026-44849 | 높음8.8 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure | 28/05/2026 |
| CVE-2026-44848 | 높음8.8 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints (/plugins/*) were not registered with a handler, so st | 28/05/2026 |
| CVE-2024-33662 | 높음7.5 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. | 02/10/2024 |
| CVE-2024-33661 | 심각9.1 | Portainer before 2.20.0 allows redirects when the target is not index.yaml. | 26/04/2024 |
| CVE-2024-29296 | 보통5.3 | A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not. | 10/04/2024 |
| CVE-2022-24961 | 심각9.8 | In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. | 11/02/2022 |
| CVE-2021-42650 | 보통6.1 | Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates. | 18/10/2021 |
| CVE-2020-24264 | 심각9.8 | Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be l | 16/03/2021 |
| CVE-2020-24263 | 높음8.8 | Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host. | 16/03/2021 |
| CVE-2019-16878 | 보통5.4 | Portainer before 1.22.1 has XSS (issue 2 of 2). | 07/11/2019 |
| CVE-2019-16877 | 높음8.8 | Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4). | 07/11/2019 |
| CVE-2019-16876 | 높음7.5 | Portainer before 1.22.1 allows Directory Traversal. | 07/11/2019 |
| CVE-2019-16872 | 심각9.9 | Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). | 07/11/2019 |