JU
Product
Jumpserver
24
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 5Medium 10Low 0
Watch
Add Jumpserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-29202 | 9.9 | Mar 29 | JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery Affected: 3.0.0 before 3.10.7 |
| CVE-2024-29201 | 9.9 | Mar 29 | JumpServer's insecure Ansible playbook validation leads to RCE in Celery Affected: 3.0.0 before 3.10.7 |
| CVE-2023-43651 | 9.9 | Sep 27 | Remote code execution on the host system via MongoDB shell in jumpserver Affected: 2.0.0 before 2.28.20; 3.0.0 before 3.7.1 |
| CVE-2023-28110 | 9.9 | Mar 16 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service Affected: before 2.28.8 |
| CVE-2024-40629 | 9.8 | Jul 18 | Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver Affected: 3.0.0 before 3.10.12 |
| CVE-2023-48193 | 9.8 | Nov 28 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function Affected: 3.8.0 |
| CVE-2023-42818 | 9.8 | Sep 27 | SSH public key login without private key challenge if mfa is enabled in jumpserver Affected: before 3.5.6; 3.6.0 before 3.6.5 |
| CVE-2024-40628 | 9.1 | Jul 18 | Arbitrary File Read in Ansible Playbooks in Jumpserver Affected: 3.0.0 before 3.10.12 |
| CVE-2023-43652 | 9.1 | Sep 27 | Non-MFA account takeover via using only SSH public key to login in jumpserver Affected: 2.0.0 before 2.28.20; 3.0.0 before 3.7.1 |
| CVE-2023-42819 | 8.8 | Sep 26 | Path traversal in Jumpserver Affected: 3.0.0 before 3.6.5 |
| CVE-2023-42820 | 8.2 | Sep 26 | Random seed leakage in Jumpserver Affected: 2.24.0 before 2.28.19; 3.0.0 before 3.6.5 |
| CVE-2025-62712 | 8.1 | Oct 30 | JumpServer Connection Token Leak Vulnerability Affected: before 3.10.20; 4.0.0 before 4.10.11 |
| CVE-2023-43650 | 7.4 | Sep 27 | Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver Affected: 2.0.0 before 2.28.20; 3.0.0 before 3.7.1 |
| CVE-2025-62795 | 7.1 | Oct 30 | JumpServer Unauthorized LDAP Configuration Access via WebSocket Affected: before 3.10.21; 4.0.0 before 4.10.12 |
| CVE-2026-31864 | 6.8 | Mar 13 | JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering Affected: before 3.10.22; 4.0.0 before 4.10.16 |
| CVE-2025-58044 | 6.1 | Dec 1 | JumpServer has an Open Redirect Vulnerability Affected: before 3.10.19; 4.0.0 before 4.10.5 |
| CVE-2024-24763 | 6.1 | Feb 20 | JumpServer Open Redirect Vulnerability Affected: before 3.10.0 |
| CVE-2024-29020 | 5.3 | Mar 29 | JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked Affected: 3.0.0 before 3.10.6 |
| CVE-2024-29024 | 5.3 | Mar 29 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality Affected: 3.0.0 before 3.10.6 |
| CVE-2023-46138 | 5.3 | Oct 30 | JumpServer default admin user email leak password reset Affected: before 3.8.0 |
| CVE-2023-46123 | 5.3 | Oct 25 | jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values Affected: before 3.8.0 |
| CVE-2023-42442 | 5.3 | Sep 15 | JumpServer session replays download without authentication Affected: 3.0.0 before 3.5.5; 3.6.0 before 3.6.4 |
| CVE-2026-31798 | 5.0 | Mar 13 | JumpServer Improper Certificate Validation in Custom SMS API Client Affected: before 4.10.16 |
| CVE-2025-27095 | 4.3 | Mar 31 | JumpServer has a Kubernetes Token Leak Vulnerability Affected: before 3.10.18; 4.0.0 before 4.8.0 |
Showing 24