AR
Product
artifactory
On CISA KEVExploited in the wild
75
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 38Low 3
Watch
Add artifactory to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-2247 | 6.1 | Mar 13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism Affected: through 7.77.7 |
| CVE-2021-45721 | 6.1 | Jul 6 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.29.8 |
| CVE-2026-69107 | 5.9 | Aug 12 | Potential unauthorized artifact access in JFrog Artifactory Affected: before 7.104.16; 7.111.0 before 7.111.14; 7.117.0 before 7.117.21; 7.125.0 before 7.125.14; 7.133.0 before 7.133.21; 7.146.0 before 7.146.8 |
| CVE-2026-66376 | 5.4 | Aug 12 | Deleted users may temporarily retain access to JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-65922 | 5.4 | Jul 27 | Potential unauthorized modification of Artifactory internal metadata Affected: before 7.111.18; 7.117.0 before 7.117.25; 7.125.0 before 7.125.18; 7.133.0 before 7.133.27; 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2021-45074 | 5.4 | Mar 2 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a… Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.29.3 |
| CVE-2026-66381 | 5.3 | Aug 12 | Repository readers may access content outside configured upstream paths Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68760 | 5.3 | Aug 12 | Potential remember-me authentication bypass in JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66377 | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory repository information Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68753 | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory content under specific configurations Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2021-46687 | 4.9 | Jul 6 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.31.10 |
| CVE-2021-45730 | 4.9 | May 19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts… Affected: 7.0.0 before 7.31.10 |
| CVE-2026-70547 | 4.3 | Aug 12 | Potential unauthorized metadata exposure in JFrog Artifactory Affected: 7.161.0 before 7.161.16 |
| CVE-2026-66382 | 4.3 | Aug 12 | Authenticated users may write files outside the intended Artifactory work directory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66379 | 4.3 | Aug 12 | Authenticated users may view private Puppet module metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66378 | 4.3 | Aug 12 | Authenticated users may access private NuGet metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68755 | 4.3 | Aug 12 | Bundle writers may alter trusted release information in JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66380 | 4.3 | Aug 12 | Authenticated users may access private OCI referrer metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2024-3505 | 4.3 | Apr 15 | JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy… Affected: before 7.77.3 |
| CVE-2019-10323 | 4.3 | May 31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate… Affected: through 3.2.3 |
| CVE-2019-10322 | 4.3 | May 31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect… Affected: through 3.2.2 |
| CVE-2019-10321 | 4.3 | May 31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read… Affected: through 3.2.2 |
| CVE-2026-70548 | 3.5 | Aug 25 | SSRF In CocoaPods Via JFrog Artifactory External Dependency Affected: 7.161.11 before 7.161.19; 7.146.0 before 7.146.36 |
| CVE-2026-65926 | 3.1 | Aug 12 | Private Release Bundle versions may be disclosed under specific configurations Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2021-46270 | 2.7 | Mar 2 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission… Affected: 7.0.0 before 7.31.10 |