{"schema_version":1,"title":"Dromara Jpom vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 5 vulnerabilities in Dromara Jpom: 0 in the last 7 days and 5 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120461, was published on 2 November 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1). 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/jpom","json_url":"https://junglewise.ai/threats/technologies/jpom.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/jpom","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":3,"all_time":5,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":5,"last_365_days":5},"latest":[{"cve":"CVE-2026-120461","cvss":8.8,"slug":"cve-2026-120461-jpom-through-2-11-12-contains-a-cross-workspace-authorization","title":"Jpom cross-workspace authorization bypass in SSH command execution","severity":"high","exploited":false,"published_at":"2026-11-02T15:17:30.247+00:00","url":"https://junglewise.ai/threats/cve-2026-120461-jpom-through-2-11-12-contains-a-cross-workspace-authorization"},{"cve":"CVE-2026-120460","cvss":8.8,"slug":"cve-2026-120460-jpom-through-2-11-12-contains-a-cross-workspace-authorization","title":"Jpom cross-workspace authorization bypass in Docker management","severity":"high","exploited":false,"published_at":"2026-11-02T15:17:30.053+00:00","url":"https://junglewise.ai/threats/cve-2026-120460-jpom-through-2-11-12-contains-a-cross-workspace-authorization"},{"cve":"CVE-2026-120201","cvss":9.8,"slug":"cve-2026-120201-jpom-2-10-0-through-2-11-12-contains-an-authentication-bypass","title":"Jpom authentication bypass in login interceptor","severity":"critical","exploited":false,"published_at":"2026-10-31T18:17:07.89+00:00","url":"https://junglewise.ai/threats/cve-2026-120201-jpom-2-10-0-through-2-11-12-contains-an-authentication-bypass"},{"cve":"CVE-2026-111605","cvss":8.1,"slug":"cve-2026-111605-jpom-through-2-11-12-contains-an-authorization-bypass","title":"Jpom authorization bypass in SshFileController","severity":"high","exploited":false,"published_at":"2026-10-16T18:17:39.49+00:00","url":"https://junglewise.ai/threats/cve-2026-111605-jpom-through-2-11-12-contains-an-authorization-bypass"},{"cve":"CVE-2026-91993","cvss":4.3,"epss":0.0034,"slug":"cve-2026-91993-jpom-workspace-isolation-bypass-in-repository-enumeration","title":"Jpom workspace isolation bypass in repository enumeration","severity":"medium","exploited":false,"published_at":"2026-09-15T12:17:54.64+00:00","url":"https://junglewise.ai/threats/cve-2026-91993-jpom-workspace-isolation-bypass-in-repository-enumeration"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Dromara Lamp-Cloud","slug":"lamp-cloud","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/lamp-cloud"},{"name":"Dromara RuoYi-Vue-Plus","slug":"ruoyi-vue-plus","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/ruoyi-vue-plus"},{"name":"Dromara Skyeye","slug":"skyeye","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/skyeye"}],"technology":{"hub":true,"name":"Dromara Jpom","slug":"jpom","vendor":{"hub":true,"name":"Dromara","slug":"dromara","url":"https://junglewise.ai/threats/vendors/dromara"},"aliases":[],"category":"ci-cd","description":"CI/CD platform for continuous integration and deployment automation.","url":"https://junglewise.ai/threats/technologies/jpom"},"most_severe":[{"cve":"CVE-2026-120201","cvss":9.8,"slug":"cve-2026-120201-jpom-2-10-0-through-2-11-12-contains-an-authentication-bypass","title":"Jpom authentication bypass in login interceptor","severity":"critical","exploited":false,"published_at":"2026-10-31T18:17:07.89+00:00","url":"https://junglewise.ai/threats/cve-2026-120201-jpom-2-10-0-through-2-11-12-contains-an-authentication-bypass"},{"cve":"CVE-2026-120461","cvss":8.8,"slug":"cve-2026-120461-jpom-through-2-11-12-contains-a-cross-workspace-authorization","title":"Jpom cross-workspace authorization bypass in SSH command execution","severity":"high","exploited":false,"published_at":"2026-11-02T15:17:30.247+00:00","url":"https://junglewise.ai/threats/cve-2026-120461-jpom-through-2-11-12-contains-a-cross-workspace-authorization"},{"cve":"CVE-2026-120460","cvss":8.8,"slug":"cve-2026-120460-jpom-through-2-11-12-contains-a-cross-workspace-authorization","title":"Jpom cross-workspace authorization bypass in Docker management","severity":"high","exploited":false,"published_at":"2026-11-02T15:17:30.053+00:00","url":"https://junglewise.ai/threats/cve-2026-120460-jpom-through-2-11-12-contains-a-cross-workspace-authorization"},{"cve":"CVE-2026-111605","cvss":8.1,"slug":"cve-2026-111605-jpom-through-2-11-12-contains-an-authorization-bypass","title":"Jpom authorization bypass in SshFileController","severity":"high","exploited":false,"published_at":"2026-10-16T18:17:39.49+00:00","url":"https://junglewise.ai/threats/cve-2026-111605-jpom-through-2-11-12-contains-an-authorization-bypass"},{"cve":"CVE-2026-91993","cvss":4.3,"epss":0.0034,"slug":"cve-2026-91993-jpom-workspace-isolation-bypass-in-repository-enumeration","title":"Jpom workspace isolation bypass in repository enumeration","severity":"medium","exploited":false,"published_at":"2026-09-15T12:17:54.64+00:00","url":"https://junglewise.ai/threats/cve-2026-91993-jpom-workspace-isolation-bypass-in-repository-enumeration"}],"generated_at":"2026-11-10T03:07:00.198065+00:00"}