CVEs we hold for Jfrog
Records whose assigning authority named Jfrog as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactoryjfrog artifactory
CVE-2026-70551Server-Side Request Forgery Via VCS remote download in JFrog Artifactoryjfrog artifactory
CVE-2026-70550Potential unauthorized access to private Composer repository metadata in JFrog Artifactoryjfrog artifactory
CVE-2026-68758Authenticated users may access restricted Artifactory support informationjfrog artifactory
CVE-2026-68755Bundle writers may alter trusted release information in JFrog Artifactoryjfrog artifactory
CVE-2026-68754Publishers without delete permission can overwrite docker layer informationjfrog artifactory
CVE-2026-68753Anonymous users may access restricted Artifactory content under specific configurationsjfrog artifactory
CVE-2026-68752Project Resource Managers may escalate privileges in JFrog Artifactoryjfrog artifactory
CVE-2026-66384Authenticated users may write data outside the intended Docker cache pathjfrog artifactory
CVE-2026-66382Authenticated users may write files outside the intended Artifactory work directoryjfrog artifactory
CVE-2026-66381Repository readers may access content outside configured upstream pathsjfrog artifactory
CVE-2026-66377Anonymous users may access restricted Artifactory repository informationjfrog artifactory
CVE-2026-66016Rendered Artifactory Helm manifests may contain generated TLS private keysjfrog artifactory
CVE-2026-66015JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.jfrog artifactory
CVE-2026-66014Potential authentication bypass leading to privilege escalation in Artifactoryjfrog artifactory
CVE-2026-65926Private Release Bundle versions may be disclosed under specific configurationsjfrog artifactory
CVE-2026-65925Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repositoryjfrog artifactory
CVE-2026-65923Potential server-side request forgery in Artifactory Ansible repository handlingjfrog artifactory
CVE-2026-65618Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerabilityjfrog artifactory
CVE-2026-65617Potential remote code execution on an Artifactory package service container.jfrog artifactory
CVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalationjfrog artifactory
CVE-2024-4142JFrog Artifactory Improper input validation within token creation flowJFrog Artifactory
CVE-2024-3505JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege usersJFrog Artifactory Self-Hosted
CVE-2023-42662JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access TokensJFrog Artifactory
CVE-2023-42661JFrog Artifactory Improper input validation leads to arbitrary file writeJFrog Artifactory
CVE-2023-42509JFrog Artifactory Sensitive Data Leakage in Repository configuration processJFrog Artifactory
CVE-2023-42508JFrog Artifactory Improper header input validation leads to email manipulation sent from the platformJFrog Artifactory
65 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.