Jpom vulnerabilities
CVEs whose affected-version data names the Jpom package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111605High· 8.1PoCJpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH f…
▾ Midnightdromara · JpomEPSS 0.32%via CVEORG
CVE-2026-91993Medium· 4.3PoCJpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identif…
▾ Twilightdromara · JpomEPSS 0.34%via NVD