CVEs we hold for Jumpserver

Records whose assigning authority named Jumpserver as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-54336JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Assetjumpserver

CVE-2026-44846JumpServer: Privilege Overwrite via Organization Invite Logic Flawjumpserver

CVE-2026-44845JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deploymentjumpserver

CVE-2026-31864JumpServer has a Server-Side Template Injection Leading to RCE via YAML Renderingjumpserver

CVE-2026-31798JumpServer Improper Certificate Validation in Custom SMS API Clientjumpserver

CVE-2025-62795JumpServer Unauthorized LDAP Configuration Access via WebSocketjumpserver

CVE-2025-62712JumpServer Connection Token Leak Vulnerabilityjumpserver

CVE-2025-58044JumpServer has an Open Redirect Vulnerabilityjumpserver

CVE-2025-27095JumpServer has a Kubernetes Token Leak Vulnerabilityjumpserver

CVE-2024-40629Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserverjumpserver

CVE-2024-40628Arbitrary File Read in Ansible Playbooks in Jumpserverjumpserver

CVE-2024-29202JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celeryjumpserver

CVE-2024-29201JumpServer's insecure Ansible playbook validation leads to RCE in Celeryjumpserver

CVE-2024-29024JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionalityjumpserver

CVE-2024-29020JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leakedjumpserver

CVE-2024-24763JumpServer Open Redirect Vulnerabilityjumpserver

CVE-2023-46138JumpServer default admin user email leak password resetjumpserver

CVE-2023-46123jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP valuesjumpserver

CVE-2023-43652Non-MFA account takeover via using only SSH public key to login in jumpserverjumpserver

CVE-2023-43651Remote code execution on the host system via MongoDB shell in jumpserverjumpserver

CVE-2023-43650Non-MFA account takeover via brute-force attack on weak password reset code in jumpserverjumpserver

CVE-2023-42820Random seed leakage in Jumpserverjumpserver

CVE-2023-42819Path traversal in Jumpserverjumpserver

CVE-2023-42818SSH public key login without private key challenge if mfa is enabled in jumpserverjumpserver

CVE-2023-42442JumpServer session replays download without authenticationjumpserver

CVE-2023-28110JumpServer Koko vulnerable to Command Injection for Kubernetes Connectionjumpserver

26 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.