JU
Vendor
jumpserver
29
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112159 | JU JumpServer Jumpserver | 5.5 | Oct 19 | JumpServer Template Rendering os command injection |
| CVE-2026-104126 | JU jumpserver jumpserver | 6.0 | Oct 13 | JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation |
| CVE-2026-44846 | JU jumpserver jumpserver | 6.2 | Aug 17 | JumpServer: Privilege Overwrite via Organization Invite Logic Flaw |
| CVE-2026-44845 | JU jumpserver jumpserver | 6.7 | Aug 17 | JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment |
| CVE-2026-54336 | JU jumpserver jumpserver | 5.4 | Aug 17 | JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset |
| CVE-2026-31864 | JU jumpserver jumpserver | 6.8 | Mar 13 | JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering |
| CVE-2026-31798 | JU jumpserver jumpserver | 5.0 | Mar 13 | JumpServer Improper Certificate Validation in Custom SMS API Client |
| CVE-2025-58044 | JU jumpserver jumpserver | 6.1 | Dec 1 | JumpServer has an Open Redirect Vulnerability |
| CVE-2025-62795 | JU jumpserver jumpserver | 7.1 | Oct 30 | JumpServer Unauthorized LDAP Configuration Access via WebSocket |
| CVE-2025-62712 | JU jumpserver jumpserver | 8.1 | Oct 30 | JumpServer Connection Token Leak Vulnerability |
| CVE-2025-27095 | JU jumpserver jumpserver | 4.3 | Mar 31 | JumpServer has a Kubernetes Token Leak Vulnerability |
| CVE-2024-40628 | JU jumpserver jumpserver | 9.1 | Jul 18 | Arbitrary File Read in Ansible Playbooks in Jumpserver |
| CVE-2024-40629 | JU jumpserver jumpserver | 9.8 | Jul 18 | Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver |
| CVE-2024-29202 | JU jumpserver jumpserver | 9.9 | Mar 29 | JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery |
| CVE-2024-29201 | JU jumpserver jumpserver | 9.9 | Mar 29 | JumpServer's insecure Ansible playbook validation leads to RCE in Celery |
| CVE-2024-29020 | JU jumpserver jumpserver | 5.3 | Mar 29 | JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked |
| CVE-2024-29024 | JU jumpserver jumpserver | 5.3 | Mar 29 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality |
| CVE-2024-24763 | JU jumpserver jumpserver | 6.1 | Feb 20 | JumpServer Open Redirect Vulnerability |
| CVE-2023-46138 | JU jumpserver jumpserver | 5.3 | Oct 30 | JumpServer default admin user email leak password reset |
| CVE-2023-46123 | JU jumpserver jumpserver | 5.3 | Oct 25 | jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values |
| CVE-2023-42818 | JU jumpserver jumpserver | 9.8 | Sep 27 | SSH public key login without private key challenge if mfa is enabled in jumpserver |
| CVE-2023-43651 | JU jumpserver jumpserver | 9.9 | Sep 27 | Remote code execution on the host system via MongoDB shell in jumpserver |
| CVE-2023-43650 | JU jumpserver jumpserver | 7.4 | Sep 27 | Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver |
| CVE-2023-43652 | JU jumpserver jumpserver | 9.1 | Sep 27 | Non-MFA account takeover via using only SSH public key to login in jumpserver |
| CVE-2023-42819 | JU jumpserver jumpserver | 8.8 | Sep 26 | Path traversal in Jumpserver |
| CVE-2023-42820 | JU jumpserver jumpserver | 8.2 | Sep 26 | Random seed leakage in Jumpserver |
| CVE-2023-42442 | JU jumpserver jumpserver | 5.3 | Sep 15 | JumpServer session replays download without authentication |
| CVE-2023-28110 | JU jumpserver jumpserver | 9.9 | Mar 16 | JumpServer Koko vulnerable to Command Injection for Kubernetes Connection |
| CVE-2021-3169 | JU Jumpserver Jumpserver | 9.8 | Jul 23 | An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to… |