JF
Vendor
jfrog
81
CVEs
4
On KEV
1
New 30D
Products
JF9.0
jfrog-cli
jfrog
1 CVEs0 on KEV1 new
AR9.8
artifactory
jfrog
78 CVEs4 on KEV0 new
AS4.3
Artifactory Self-Hosted
JFrog
1 CVEs0 on KEV0 new
AW4.9
Artifactory (Workers)
JFrog
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92892 | JF jfrog-cli jfrog | 9.0 | Oct 13 | Potential command execution on the host running JFrog CLI. |
| CVE-2026-82329 In wildKEV | AR artifactory jfrog | 9.8 | Aug 28 | Potential authentication bypass leading to administrative access in Artifactory |
| CVE-2026-70550 | AR artifactory jfrog | 6.5 | Aug 25 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory |
| CVE-2026-70548 | AR artifactory jfrog | 3.5 | Aug 25 | SSRF In CocoaPods Via JFrog Artifactory External Dependency |
| CVE-2026-69104 | AR artifactory jfrog | 7.6 | Aug 25 | Potential unauthorized repository migration in JFrog Artifactory |
| CVE-2026-70551 | AR artifactory jfrog | 8.5 | Aug 25 | Server-Side Request Forgery Via VCS remote download in JFrog Artifactory |
| CVE-2026-69106 | AR artifactory jfrog | 8.8 | Aug 12 | Potential cache poisoning in JFrog Artifactory |
| CVE-2026-42018 In wildKEV | AR artifactory jfrog | 7.5 | Aug 12 | Anonymous user token generation exposure in JFrog Artifactory |
| CVE-2026-69107 | AR artifactory jfrog | 5.9 | Aug 12 | Potential unauthorized artifact access in JFrog Artifactory |
| CVE-2026-69105 | AR artifactory jfrog | 8.1 | Aug 12 | Potential package cache integrity issue in JFrog Artifactory |
| CVE-2026-70547 | AR artifactory jfrog | 4.3 | Aug 12 | Potential unauthorized metadata exposure in JFrog Artifactory |
| CVE-2026-66016 | AR artifactory jfrog | 6.7 | Aug 12 | Rendered Artifactory Helm manifests may contain generated TLS private keys |
| CVE-2026-68759 | AR artifactory jfrog | 7.2 | Aug 12 | Integration credential holders may impersonate users in JFrog Access |
| CVE-2026-65926 | AR artifactory jfrog | 3.1 | Aug 12 | Private Release Bundle versions may be disclosed under specific configurations |
| CVE-2026-66384 In wildKEV | AR artifactory jfrog | 5.3 | Aug 12 | Authenticated users may write data outside the intended Docker cache path |
| CVE-2026-68758 | AR artifactory jfrog | 6.5 | Aug 12 | Authenticated users may access restricted Artifactory support information |
| CVE-2026-66375 | AR artifactory jfrog | 8.1 | Aug 12 | Low-privilege users may remove protected Artifactory metadata |
| CVE-2026-68757 | AR artifactory jfrog | 7.5 | Aug 12 | Potential improper SAML signature verification in JFrog Artifactory |
| CVE-2026-68756 | AR artifactory jfrog | 6.6 | Aug 12 | Potential insecure deserialization in JFrog Artifactory |
| CVE-2026-66382 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may write files outside the intended Artifactory work directory |
| CVE-2026-66381 | AR artifactory jfrog | 5.3 | Aug 12 | Repository readers may access content outside configured upstream paths |
| CVE-2026-68760 | AR artifactory jfrog | 5.3 | Aug 12 | Potential remember-me authentication bypass in JFrog Artifactory |
| CVE-2026-66379 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may view private Puppet module metadata |
| CVE-2026-66378 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may access private NuGet metadata |
| CVE-2026-66377 | AR artifactory jfrog | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory repository information |
| CVE-2026-68755 | AR artifactory jfrog | 4.3 | Aug 12 | Bundle writers may alter trusted release information in JFrog Artifactory |
| CVE-2026-66380 | AR artifactory jfrog | 4.3 | Aug 12 | Authenticated users may access private OCI referrer metadata |
| CVE-2026-68754 | AR artifactory jfrog | 6.5 | Aug 12 | Publishers without delete permission can overwrite docker layer information |
| CVE-2026-68753 | AR artifactory jfrog | 5.3 | Aug 12 | Anonymous users may access restricted Artifactory content under specific configurations |
| CVE-2026-66376 | AR artifactory jfrog | 5.4 | Aug 12 | Deleted users may temporarily retain access to JFrog Artifactory |
| CVE-2026-68752 | AR artifactory jfrog | 7.2 | Aug 12 | Project Resource Managers may escalate privileges in JFrog Artifactory |
| CVE-2026-65922 | AR artifactory jfrog | 5.4 | Jul 27 | Potential unauthorized modification of Artifactory internal metadata |
| CVE-2026-65923 | AR artifactory jfrog | 6.8 | Jul 27 | Potential server-side request forgery in Artifactory Ansible repository handling |
| CVE-2026-65617 | AR artifactory jfrog | 8.8 | Jul 27 | Potential remote code execution on an Artifactory package service container. |
| CVE-2026-65924 | AR artifactory jfrog | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via Terraform Remote repository |
| CVE-2026-65925 | AR artifactory jfrog | 6.5 | Jul 27 | Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository |
| CVE-2026-65616 | AR artifactory jfrog | 8.8 | Jul 27 | Potential privilege escalation to JFrog administrator privileges |
| CVE-2026-66015 | AR artifactory jfrog | 7.2 | Jul 27 | JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. |
| CVE-2026-65618 | AR artifactory jfrog | 6.5 | Jul 27 | Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability |
| CVE-2026-66018 | AR artifactory jfrog | 6.5 | Jul 27 | JFrog Artifactory build environment properties exposure |
| CVE-2026-66014 | AR artifactory jfrog | 8.8 | Jul 27 | Potential authentication bypass leading to privilege escalation in Artifactory |
| CVE-2026-65921 | AR artifactory jfrog | 8.8 | Jul 27 | Potential path traversal leading to unauthorized file writes |
| CVE-2026-42017 | AR artifactory jfrog | 8.8 | Jul 27 | Privilege escalation via JFrog Worker event token exposure |
| CVE-2026-42016 In wildKEV | AR artifactory jfrog | 8.8 | Jul 27 | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation |
| CVE-2025-14830 | AW Artifactory (Workers) JFrog | 4.9 | Jan 4 | JFrog Artifactory Cross-Site Scripting |
| CVE-2024-6915 | AR Artifactory JFrog | 9.3 | Aug 5 | JFrog Artifactory Cache Poisoning |
| CVE-2024-2248 | AR Artifactory JFrog | 6.4 | May 15 | JFrog Artifactory Header Injection |
| CVE-2024-4142 | AR Artifactory JFrog | 9.0 | May 1 | JFrog Artifactory Improper input validation within token creation flow |
| CVE-2024-3505 | AS Artifactory Self-Hosted JFrog | 4.3 | Apr 15 | JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users |
| CVE-2024-2247 | AR Artifactory JFrog | 6.1 | Mar 13 | JFrog Artifactory Cross-Site Scripting |
| CVE-2023-42509 | AR Artifactory JFrog | 7.5 | Mar 7 | JFrog Artifactory Sensitive Data Leakage in Repository configuration process |
| CVE-2023-42661 | AR Artifactory JFrog | 8.8 | Mar 7 | JFrog Artifactory Improper input validation leads to arbitrary file write |
| CVE-2023-42662 | AR Artifactory JFrog | 6.5 | Mar 7 | JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens |
| CVE-2023-42508 | AR Artifactory Jfrog | 6.5 | Oct 3 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send… |
| CVE-2022-0668 | AR Artifactory Jfrog | 9.8 | Jan 8 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated… |
| CVE-2021-46687 | AR Artifactory Jfrog | 4.9 | Jul 6 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API |
| CVE-2021-45721 | AR Artifactory Jfrog | 6.1 | Jul 6 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint |
| CVE-2021-23163 | AR Artifactory Jfrog | 8.8 | Jul 6 | JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints |
| CVE-2021-41834 | AR Artifactory Jfrog | 6.5 | May 23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any… |
| CVE-2021-45730 | AR Artifactory Jfrog | 4.9 | May 19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts… |