Skip to content
Noroxi

portainer records

26 published records for vendor portainer.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
38.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 24
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2020-24264
    40Plan

    Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution.

    CriticalCVSS 9.8No exploitEPSS 4%

    portainer · portainerMar 16, 2021

  • CVE-2018-19466
    40Plan

    A vulnerability was found in Portainer before 1.20.0.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    portainer · portainerMar 27, 2019

  • CVE-2018-12678
    40Plan

    Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocke

    CriticalCVSS 9.8No exploitEPSS 2%

    portainer · portainerJun 22, 2018

  • CVE-2022-24961
    39Monitor

    In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.

    CriticalCVSS 9.8No exploitEPSS 2%

    portainer · portainerFeb 11, 2022

  • CVE-2018-19367
    39Monitor

    Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created.

    CriticalCVSS 9.8No exploitEPSS 1%

    portainer · portainerNov 20, 2018

  • CVE-2019-16872
    39Monitor

    Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).

    CriticalCVSS 9.9No exploitEPSS 1%

    portainer · portainerNov 7, 2019

  • CVE-2026-44849
    37Monitor

    Portainer: Endpoint security bypass via Swarm service create/update

    CriticalCVSS 9.4No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-44848
    37Monitor

    Portainer: Missing authorization on Docker plugin endpoints allows host RCE

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2024-33661
    36Monitor

    Portainer before 2.20.0 allows redirects when the target is not index.yaml.

    CriticalCVSS 9.1No exploitEPSS 1%

    portainer · portainerApr 25, 2024

  • CVE-2020-24263
    35Monitor

    Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.

    HighCVSS 8.8No exploitEPSS 2%

    portainer · portainerMar 16, 2021

  • CVE-2019-16877
    35Monitor

    Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).

    HighCVSS 8.8No exploitEPSS 1%

    portainer · portainerNov 7, 2019

  • CVE-2026-44881
    34Monitor

    Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

    HighCVSS 8.5Proof of conceptEPSS 1%

    portainer · portainerMay 28, 2026

  • CVE-2026-44850
    34Monitor

    Portainer: Bind-mount restriction bypass via HostConfig.Mounts

    HighCVSS 8.5No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-44882
    32Monitor

    Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization

    HighCVSS 8.1No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2019-16876
    30Monitor

    Portainer before 1.22.1 allows Directory Traversal.

    HighCVSS 7.5No exploitEPSS 1%

    portainer · portainerNov 7, 2019

  • CVE-2026-44883
    30Monitor

    Portainer: JWT accepted in URL query leaks tokens to logs and referers

    HighCVSS 7.7No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2024-33662
    30Monitor

    Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.

    HighCVSS 7.5No exploitEPSS 0%

    portainer · portainerOct 2, 2024

  • CVE-2026-55761
    28Monitor

    Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances

    HighCVSS 7.1No exploitEPSS 0%

    portainer · portainerJul 8, 2026

  • CVE-2019-16874
    26Monitor

    Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

    MediumCVSS 6.5No exploitEPSS 1%

    portainer · portainerNov 7, 2019

  • CVE-2021-42650
    24Monitor

    Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.

    MediumCVSS 6.1No exploitEPSS 1%

    portainer · portainerOct 18, 2021

  • CVE-2026-44884
    24Monitor

    Portainer: Missing authorization on custom template file endpoint exposes template content

    MediumCVSS 6.0No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-44885
    22Monitor

    Portainer: Path traversal in backup archive extraction allows arbitrary file write

    MediumCVSS 5.5No exploitEPSS 1%

    portainer · portainerMay 28, 2026

  • CVE-2024-29296
    21Monitor

    A user enumeration vulnerability was found in Portainer CE 2.19.4.

    MediumCVSS 5.3Proof of conceptEPSS 1%

    portainer · portainerApr 10, 2024

  • CVE-2018-16316
    21Monitor

    A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScri

    MediumCVSS 5.4No exploitEPSS 1%

    portainer · portainerSep 1, 2018

  • CVE-2019-16873
    21Monitor

    Portainer before 1.22.1 has XSS (issue 1 of 2).

    MediumCVSS 5.4No exploitEPSS 1%

    portainer · portainerNov 7, 2019