65
CVEs
20
Critical
22
High
0
KEV
44
PoC
17
Unpatched C/H
52.3%
Patch Rate
4.5%
Avg EPSS
Severity Breakdown
CRITICAL
20
HIGH
22
MEDIUM
19
LOW
4
Monthly CVE Trend
Affected Products (17)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-48193 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.0% | 71 |
PoC
No patch
|
| CVE-2023-28110 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | CRITICAL | 9.9 | 0.8% | 70 |
PoC
|
| CVE-2023-43651 | JumpServer is an open source bastion host. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.9 | 1.7% | 70 |
PoC
|
| CVE-2024-29201 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.9 | 5.9% | 70 |
PoC
No patch
|
| CVE-2024-29202 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.9 | 5.9% | 70 |
PoC
No patch
|
| CVE-2025-70981 | SQL injection in CordysCRM 1.4.1 employee list query via departmentIds parameter. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2023-22463 | KubePi is a k8s panel. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 69.7% | 69 |
PoC
|
| CVE-2023-22480 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 66.8% | 69 |
PoC
|
| CVE-2023-38692 | CloudExplorer Lite is an open source, lightweight cloud management platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.8% | 69 |
PoC
No patch
|
| CVE-2023-39966 | 1Panel is an open source Linux server operation and maintenance management panel. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
|
| CVE-2023-42405 | SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.0% | 69 |
PoC
No patch
|
| CVE-2023-42818 | JumpServer is an open source bastion host. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.6% | 69 |
PoC
|
| CVE-2023-44397 | CloudExplorer Lite is an open source, lightweight cloud management platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.6% | 69 |
PoC
No patch
|
| CVE-2024-2352 | A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 3.0% | 69 |
PoC
|
| CVE-2024-39907 | 1Panel is a web-based linux server management control panel. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 29.4% | 69 |
PoC
|