Jjumpserver

Products

Exploited and recent CVEs

• CVE-2026-104126 Medium 6.0 JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation 0.4%
• CVE-2026-44846 Medium 6.2 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw 0.4%
• CVE-2026-44845 Medium 6.7 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment 0.7%
• CVE-2026-54336 Medium 5.4 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset 0.3%
• CVE-2026-31864 Medium 6.8 JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering 0.4%
• CVE-2026-31798 Medium 5.0 JumpServer Improper Certificate Validation in Custom SMS API Client 0.1%
• CVE-2025-58044 Medium 5.5 JumpServer has an Open Redirect Vulnerability 0.5%
• CVE-2025-62795 High 7.1 JumpServer Unauthorized LDAP Configuration Access via WebSocket 0.3%
• CVE-2025-62712 Critical 9.6 JumpServer Connection Token Leak Vulnerability 0.5%
• CVE-2025-27095 Medium 4.3 JumpServer has a Kubernetes Token Leak Vulnerability 0.3%
• CVE-2024-40628 Critical 10.0 Arbitrary File Read in Ansible Playbooks in Jumpserver 0.9%
• CVE-2024-40629 Critical 10.0 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver 1.3%
• CVE-2024-29202 Critical 10.0 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery 5.9%
• CVE-2024-29201 Critical 10.0 JumpServer's insecure Ansible playbook validation leads to RCE in Celery 6.0%
• CVE-2024-29020 Medium 4.6 JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked 0.3%
• CVE-2024-29024 Medium 4.6 JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality 0.2%
• CVE-2024-24763 Medium 4.3 JumpServer Open Redirect Vulnerability 1.1%
• CVE-2023-46138 Low 3.7 JumpServer default admin user email leak password reset 0.4%
• CVE-2023-46123 Medium 5.3 jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values 0.9%
• CVE-2023-42818 Medium 5.4 SSH public key login without private key challenge if mfa is enabled in jumpserver 0.7%
• CVE-2023-43651 High 8.6 Remote code execution on the host system via MongoDB shell in jumpserver 2.1%
• CVE-2023-43650 High 8.2 Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver 0.6%
• CVE-2023-43652 High 8.2 Non-MFA account takeover via using only SSH public key to login in jumpserver 0.8%
• CVE-2023-42819 High 8.9 Path traversal in Jumpserver 2.2%
• CVE-2023-42820 High 7.0 Random seed leakage in Jumpserver 6.3%
• CVE-2023-42442 High 8.2 JumpServer session replays download without authentication 63.0%
• CVE-2023-28110 Medium 5.7 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection 0.8%