AR
Product
artifactory
On CISA KEVExploited in the wild
75
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 38Low 3
Watch
Add artifactory to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66384 In wildKEV | 5.3 | Aug 12 | Authenticated users may write data outside the intended Docker cache path Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-65923 | 6.8 | Jul 27 | Potential server-side request forgery in Artifactory Ansible repository handling Affected: before 7.111.18; 7.117.0 before 7.117.25; 7.125.0 before 7.125.18; 7.133.0 before 7.133.27; 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2026-66016 | 6.7 | Aug 12 | Rendered Artifactory Helm manifests may contain generated TLS private keys Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68756 | 6.6 | Aug 12 | Potential insecure deserialization in JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-70550 | 6.5 | Aug 25 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory Affected: 7.161.0 before 7.161.19; 7.146.0 before 7.146.29 |
| CVE-2026-68758 | 6.5 | Aug 12 | Authenticated users may access restricted Artifactory support information Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68754 | 6.5 | Aug 12 | Publishers without delete permission can overwrite docker layer information Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-65924 | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via Terraform Remote repository Affected: before 7.111.18; 7.117.0 before 7.117.25; 7.125.0 before 7.125.18; 7.133.0 before 7.133.27; 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2026-65925 | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository Affected: before 7.111.18; 7.117.0 before 7.117.25; 7.125.0 before 7.125.18; 7.133.0 before 7.133.27; 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2026-65618 | 6.5 | Jul 27 | Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability Affected: before 7.133.6 |
| CVE-2026-66018 | 6.5 | Jul 27 | JFrog Artifactory build environment properties exposure Affected: 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2023-42662 | 6.5 | Mar 7 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead… Affected: 7.59.0 before 7.59.18; 7.63.5 before 7.63.18; 7.68.7 before 7.68.19; 7.71.2 before 7.71.8 |
| CVE-2023-42508 | 6.5 | Oct 3 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send… Affected: 7.0.0 before 7.66.0 |
| CVE-2021-41834 | 6.5 | May 23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any… Affected: before 6.23.38; 7.0.0 before 7.28.0 |
| CVE-2020-2164 | 6.5 | Mar 25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by… Affected: through 3.5.0 |
| CVE-2019-10324 | 6.5 | May 31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging,… Affected: through 3.2.2 |
| CVE-2024-2247 | 6.1 | Mar 13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism Affected: through 7.77.7 |
| CVE-2021-45721 | 6.1 | Jul 6 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.29.8 |
| CVE-2026-69107 | 5.9 | Aug 12 | Potential unauthorized artifact access in JFrog Artifactory Affected: before 7.104.16; 7.111.0 before 7.111.14; 7.117.0 before 7.117.21; 7.125.0 before 7.125.14; 7.133.0 before 7.133.21; 7.146.0 before 7.146.8 |
| CVE-2026-66376 | 5.4 | Aug 12 | Deleted users may temporarily retain access to JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-65922 | 5.4 | Jul 27 | Potential unauthorized modification of Artifactory internal metadata Affected: before 7.111.18; 7.117.0 before 7.117.25; 7.125.0 before 7.125.18; 7.133.0 before 7.133.27; 7.146.0 before 7.146.34; 7.161.0 before 7.161.15 |
| CVE-2021-45074 | 5.4 | Mar 2 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a… Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.29.3 |
| CVE-2026-66381 | 5.3 | Aug 12 | Repository readers may access content outside configured upstream paths Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68760 | 5.3 | Aug 12 | Potential remember-me authentication bypass in JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66377 | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory repository information Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68753 | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory content under specific configurations Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2021-46687 | 4.9 | Jul 6 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API Affected: 6.0.0 before 6.23.38; 7.0.0 before 7.31.10 |
| CVE-2021-45730 | 4.9 | May 19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts… Affected: 7.0.0 before 7.31.10 |
| CVE-2026-70547 | 4.3 | Aug 12 | Potential unauthorized metadata exposure in JFrog Artifactory Affected: 7.161.0 before 7.161.16 |
| CVE-2026-66382 | 4.3 | Aug 12 | Authenticated users may write files outside the intended Artifactory work directory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66379 | 4.3 | Aug 12 | Authenticated users may view private Puppet module metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66378 | 4.3 | Aug 12 | Authenticated users may access private NuGet metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-68755 | 4.3 | Aug 12 | Bundle writers may alter trusted release information in JFrog Artifactory Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2026-66380 | 4.3 | Aug 12 | Authenticated users may access private OCI referrer metadata Affected: before 7.146.35; 7.161.0 before 7.161.16 |
| CVE-2024-3505 | 4.3 | Apr 15 | JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy… Affected: before 7.77.3 |
| CVE-2019-10323 | 4.3 | May 31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate… Affected: through 3.2.3 |
| CVE-2019-10322 | 4.3 | May 31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect… Affected: through 3.2.2 |
| CVE-2019-10321 | 4.3 | May 31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read… Affected: through 3.2.2 |
Showing 38