https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-120460/https://vulnfeed.org/cve/CVE-2026-120460/Mon, 02 Nov 2026 15:17:30 +0000Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.https://vulnfeed.org/cve/CVE-2026-120461/https://vulnfeed.org/cve/CVE-2026-120461/Mon, 02 Nov 2026 15:17:30 +0000Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.https://vulnfeed.org/cve/CVE-2026-120201/https://vulnfeed.org/cve/CVE-2026-120201/Sat, 31 Oct 2026 17:25:50 +0000Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.