Priority HIGH 76
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.2 +1 CWE-862
Priority HIGH 69
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00291 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.2 +1 CWE-598
Priority MEDIUM 49
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.00425 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.2 +1 CWE-862
Priority MEDIUM 49
Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04116 · Published 2021-03-16 · No fix listed CWE-863
Priority MEDIUM 48
Portainer before 2.20.0 allows redirects when the target is not index.yaml.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00623 · Published 2024-04-25 · No fix listed CWE-601
Priority MEDIUM 48
A vulnerability was found in Portainer before 1.20.0.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03721 · Published 2019-03-27 · No fix listed CWE-522
Priority MEDIUM 46
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restric…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02272 · Published 2018-06-22 · No fix listed CWE-918
Priority MEDIUM 45
In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01644 · Published 2022-02-11 · No fix listed
Priority MEDIUM 45
Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01355 · Published 2019-11-07 · No fix listed
Priority MEDIUM 45
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01469 · Published 2018-11-20 · No fix listed
Priority MEDIUM 41
Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01601 · Published 2021-03-16 · No fix listed CWE-732
Priority MEDIUM 40
Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01036 · Published 2019-11-07 · No fix listed
Priority LOW 37
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00335 · Published 2026-05-28 · Fixed in 2.33.8 CWE-863
Priority LOW 37
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.0051 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.2 +1 CWE-200
Priority LOW 36
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00234 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.2 +1 CWE-863
Priority LOW 36
Portainer before 1.22.1 allows Directory Traversal.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01352 · Published 2019-11-07 · No fix listed CWE-22
Priority LOW 35
Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00282 · Published 2024-10-02 · Fixed in 2.20.2 CWE-326
Priority LOW 33
A user enumeration vulnerability was found in Portainer CE 2.19.4.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01252 · Published 2024-04-10 · Fixed in 0.6.1-0.20240417040827-48bc7d0d92f0 CWE-286
Priority LOW 32
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0HIGH 7.1· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-07-08 · Fixed in 2.39.4, 2.43.0 CWE-287
Priority LOW 31
Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0089 · Published 2019-11-07 · No fix listed
Priority LOW 28
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00626 · Published 2021-10-18 · No fix listed CWE-79
Priority LOW 26
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00606 · Published 2026-05-28 · Fixed in 2.33.8 CWE-22
Priority LOW 26
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00257 · Published 2026-05-28 · Fixed in 2.33.8, 2.39.1 CWE-862
Priority LOW 26
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00794 · Published 2018-09-01 · No fix listed CWE-79
Priority LOW 25
Portainer before 1.22.1 has XSS (issue 2 of 2).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00516 · Published 2019-11-07 · No fix listed CWE-79
Load more
THREATIST.IORead the docs