These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-112159 is an OS command injection vulnerability in the template rendering component of JumpServer up to 4.10.19. The vulnerability can be exploited remotely by manipulating the IP/HOST argument, leading to potential unauthorized command execution. Upgrading to version 5.0.0 or applying patch fcf2904cdb884230e9676f50f37a44d09fa97040 is necessary to fix this issue. The exploit has been publicly dis [truncated]
CVE-2026-54336 is a vulnerability in JumpServer, an open-source bastion host and operation and maintenance security audit system. An authenticated user with SFTP permission can submit crafted traversal paths, allowing read, list, write, rename, or delete operations outside the intended SFTP root. This issue is fixed in version 4.10.17. The vulnerability allows attackers to access unauthorized areas of the [truncated]
CVE-2026-44845 is a vulnerability in JumpServer, an open-source bastion host and operation and maintenance security audit system. An authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field. This allows Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deploym [truncated]