jarun has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was November 2026 with 5. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. Most affected products: nnn (3), buku (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-121548High· 7.8nnn through 5.3 OS Command Injection via togglex Plugin55CVE-2026-121627Medium· 6.1buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL34CVE-2026-123201Medium· 5.3buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API29CVE-2026-121549Medium· 4.4nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins24CVE-2026-121550Low· 3.3nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling18
jarun vulnerabilities
CVEs affecting jarun, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-123201Medium· 5.3buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_…
CVE-2026-121627Medium· 6.1buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a …
CVE-2026-121548High· 7.8PoCnnn through 5.3 OS Command Injection via togglex Plugin
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which…
CVE-2026-121550Low· 3.3nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented pred…
CVE-2026-121549Medium· 4.4nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-deri…