Dromara Jpom vulnerabilities

2 CVEs affecting Dromara Jpom, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111605, published 2026-10-16.

More from Dromara.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-91993, published 2026-09-15. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces.…
• CVE-2026-111605, published 2026-10-16. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying…