JF
Vendor
jfrog
76
CVEs
4
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92892 | JF jfrog-cli jfrog | 9.0 | Oct 13 | Potential command execution on the host running JFrog CLI. |
| CVE-2026-82329 In wildKEV | AR artifactory jfrog | 9.8 | Aug 28 | Potential authentication bypass leading to administrative access in Artifactory |
| CVE-2026-70550 | AR artifactory jfrog | 6.5 | Aug 25 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory |
| CVE-2026-70548 | AR artifactory jfrog | 3.5 | Aug 25 | SSRF In CocoaPods Via JFrog Artifactory External Dependency |
| CVE-2026-69104 | AR artifactory jfrog | 7.6 | Aug 25 | Potential unauthorized repository migration in JFrog Artifactory |
| CVE-2026-70551 | AR artifactory jfrog | 8.5 | Aug 25 | Server-Side Request Forgery Via VCS remote download in JFrog Artifactory |
| CVE-2026-69106 | AR artifactory jfrog | 8.8 | Aug 12 | Potential cache poisoning in JFrog Artifactory |
| CVE-2026-42018 In wildKEV | AR artifactory jfrog | 7.5 | Aug 12 | Anonymous user token generation exposure in JFrog Artifactory |
| CVE-2026-69107 | AR artifactory jfrog | 5.9 | Aug 12 | Potential unauthorized artifact access in JFrog Artifactory |
| CVE-2026-69105 | AR artifactory jfrog | 8.1 | Aug 12 | Potential package cache integrity issue in JFrog Artifactory |
| CVE-2026-70547 | AR artifactory jfrog | 4.3 | Aug 12 | Potential unauthorized metadata exposure in JFrog Artifactory |
| CVE-2026-66016 | AR artifactory jfrog | 6.7 | Aug 12 | Rendered Artifactory Helm manifests may contain generated TLS private keys |
| CVE-2026-68759 | AR artifactory jfrog | 7.2 | Aug 12 | Integration credential holders may impersonate users in JFrog Access |
| CVE-2026-65926 | AR artifactory jfrog | 3.1 | Aug 12 | Private Release Bundle versions may be disclosed under specific configurations |
| CVE-2026-66384 In wildKEV | AR artifactory jfrog | 5.3 | Aug 12 | Authenticated users may write data outside the intended Docker cache path |
| CVE-2026-68758 | AR artifactory jfrog | 6.5 | Aug 12 | Authenticated users may access restricted Artifactory support information |
| CVE-2026-66375 | AR artifactory jfrog | 8.1 | Aug 12 | Low-privilege users may remove protected Artifactory metadata |
| CVE-2026-68757 | AR artifactory jfrog | 7.5 | Aug 12 | Potential improper SAML signature verification in JFrog Artifactory |
| CVE-2026-68756 | AR artifactory jfrog | 6.6 | Aug 12 | Potential insecure deserialization in JFrog Artifactory |
| CVE-2026-66382 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may write files outside the intended Artifactory work directory |
| CVE-2026-66381 | AR artifactory jfrog | 5.3 | Aug 12 | Repository readers may access content outside configured upstream paths |
| CVE-2026-68760 | AR artifactory jfrog | 5.3 | Aug 12 | Potential remember-me authentication bypass in JFrog Artifactory |
| CVE-2026-66379 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may view private Puppet module metadata |
| CVE-2026-66378 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may access private NuGet metadata |
| CVE-2026-66377 | AR artifactory jfrog | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory repository information |
| CVE-2026-68755 | AR artifactory jfrog | 4.3 | Aug 12 | Bundle writers may alter trusted release information in JFrog Artifactory |
| CVE-2026-66380 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may access private OCI referrer metadata |
| CVE-2026-68754 | AR artifactory jfrog | 6.5 | Aug 12 | Publishers without delete permission can overwrite docker layer information |
| CVE-2026-68753 | AR artifactory jfrog | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory content under specific configurations |
| CVE-2026-66376 | AR artifactory jfrog | 5.4 | Aug 12 | Deleted users may temporarily retain access to JFrog Artifactory |
| CVE-2026-68752 | AR artifactory jfrog | 7.2 | Aug 12 | Project Resource Managers may escalate privileges in JFrog Artifactory |
| CVE-2026-65922 | AR artifactory jfrog | 5.4 | Jul 27 | Potential unauthorized modification of Artifactory internal metadata |
| CVE-2026-65923 | AR artifactory jfrog | 6.8 | Jul 27 | Potential server-side request forgery in Artifactory Ansible repository handling |
| CVE-2026-65617 | AR artifactory jfrog | 8.8 | Jul 27 | Potential remote code execution on an Artifactory package service container. |
| CVE-2026-65924 | AR artifactory jfrog | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via Terraform Remote repository |
| CVE-2026-65925 | AR artifactory jfrog | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository |
| CVE-2026-65616 | AR artifactory jfrog | 8.8 | Jul 27 | Potential privilege escalation to JFrog administrator privileges |
| CVE-2026-66015 | AR artifactory jfrog | 7.2 | Jul 27 | JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. |
| CVE-2026-65618 | AR artifactory jfrog | 6.5 | Jul 27 | Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability |
| CVE-2026-66018 | AR artifactory jfrog | 6.5 | Jul 27 | JFrog Artifactory build environment properties exposure |
| CVE-2026-66014 | AR artifactory jfrog | 8.8 | Jul 27 | Potential authentication bypass leading to privilege escalation in Artifactory |
| CVE-2026-65921 | AR artifactory jfrog | 8.8 | Jul 27 | Potential path traversal leading to unauthorized file writes |
| CVE-2026-42017 | AR artifactory jfrog | 8.8 | Jul 27 | Privilege escalation via JFrog Worker event token exposure |
| CVE-2026-42016 In wildKEV | AR artifactory jfrog | 8.8 | Jul 27 | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation |
| CVE-2024-3505 | AR Artifactory Jfrog | 4.3 | Apr 15 | JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy… |
| CVE-2024-2247 | AR Artifactory Jfrog | 6.1 | Mar 13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism |
| CVE-2023-42661 | AR Artifactory Jfrog | 8.8 | Mar 7 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series… |
| CVE-2023-42509 | AR Artifactory Jfrog | 7.5 | Mar 7 | JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration… |
| CVE-2023-42662 | AR Artifactory Jfrog | 6.5 | Mar 7 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead… |
| CVE-2023-42508 | AR Artifactory Jfrog | 6.5 | Oct 3 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send… |
| CVE-2022-0668 | AR Artifactory Jfrog | 9.8 | Jan 8 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated… |
| CVE-2021-46687 | AR Artifactory Jfrog | 4.9 | Jul 6 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API |
| CVE-2021-45721 | AR Artifactory Jfrog | 6.1 | Jul 6 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint |
| CVE-2021-23163 | AR Artifactory Jfrog | 8.8 | Jul 6 | JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints |
| CVE-2021-41834 | AR Artifactory Jfrog | 6.5 | May 23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any… |
| CVE-2021-45730 | AR Artifactory Jfrog | 4.9 | May 19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts… |
| CVE-2022-0573 | AR Artifactory Jfrog | 8.8 | May 16 | JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when… |
| CVE-2021-46270 | AR Artifactory Jfrog | 2.7 | Mar 2 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission… |
| CVE-2021-45074 | AR Artifactory Jfrog | 5.4 | Mar 2 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a… |
| CVE-2021-3860 | AR Artifactory Jfrog | 8.8 | Dec 20 | JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when… |