JFrog CVEs
45 vulnerabilities mapped to JFrog’s software or packages, 4 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-92892 Potential command execution on the host running JFrog CLI.
CVSS 9.0 criticalEPSS 0.34%
CVE-2026-42018 Anonymous user token generation exposure in JFrog Artifactory
CVSS 7.5 highKEV added EPSS 9.8%
CVE-2026-42016 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
CVSS 8.1 highKEV added EPSS 8.6%
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
CVSS 9.8 criticalKEV added EPSS 14.4%
CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path
CVSS 5.3 mediumKEV added EPSS 0.66%
CVE-2026-70550 Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
CVSS 6.5 mediumEPSS 0.35%
CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency
CVSS 3.5 lowEPSS 0.29%
CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory
CVSS 7.6 highEPSS 0.31%
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
CVSS 8.5 highEPSS 0.30%
CVE-2026-69106 Potential cache poisoning in JFrog Artifactory
CVSS 8.8 highEPSS 0.52%
CVE-2026-69107 Potential unauthorized artifact access in JFrog Artifactory
CVSS 5.9 mediumEPSS 0.41%
CVE-2026-69105 Potential package cache integrity issue in JFrog Artifactory
CVSS 8.1 highEPSS 0.22%
CVE-2026-70547 Potential unauthorized metadata exposure in JFrog Artifactory
CVSS 4.3 mediumEPSS 0.28%
CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys
CVSS 6.7 mediumEPSS 0.12%
CVE-2026-68759 Integration credential holders may impersonate users in JFrog Access
CVSS 7.2 highEPSS 0.33%
CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations
CVSS 3.1 lowEPSS 0.24%
CVE-2026-68758 Authenticated users may access restricted Artifactory support information
CVSS 6.5 mediumEPSS 0.35%
CVE-2026-66375 Low-privilege users may remove protected Artifactory metadata
CVSS 8.1 highEPSS 0.40%
CVE-2026-68757 Potential improper SAML signature verification in JFrog Artifactory
CVSS 7.5 highEPSS 0.26%
CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory
CVSS 6.6 mediumEPSS 0.47%
CVE-2026-66382 Authenticated users may write files outside the intended Artifactory work directory
CVSS 4.3 mediumEPSS 0.35%
CVE-2026-66381 Repository readers may access content outside configured upstream paths
CVSS 5.3 mediumEPSS 0.38%
CVE-2026-68760 Potential remember-me authentication bypass in JFrog Artifactory
CVSS 5.3 mediumEPSS 0.46%
CVE-2026-66379 Authenticated users may view private Puppet module metadata
CVSS 4.3 mediumEPSS 0.30%
CVE-2026-66378 Authenticated users may access private NuGet metadata
CVSS 4.3 mediumEPSS 0.30%
CVE-2026-66377 Anonymous users may access restricted Artifactory repository information
CVSS 5.3 mediumEPSS 0.36%
CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory
CVSS 4.3 mediumEPSS 0.26%
CVE-2026-66380 Authenticated users may access private OCI referrer metadata
CVSS 4.3 mediumEPSS 0.30%
CVE-2026-68754 Publishers without delete permission can overwrite docker layer information
CVSS 6.5 mediumEPSS 0.31%
CVE-2026-68753 Anonymous users may access restricted Artifactory content under specific configurations
CVSS 5.3 mediumEPSS 0.31%
CVE-2026-66376 Deleted users may temporarily retain access to JFrog Artifactory
CVSS 4.2 mediumEPSS 0.22%
CVE-2026-68752 Project Resource Managers may escalate privileges in JFrog Artifactory
CVSS 7.2 highEPSS 0.49%
CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata
CVSS 7.1 highEPSS 0.34%
CVE-2026-65923 Potential server-side request forgery in Artifactory Ansible repository handling
CVSS 6.8 mediumEPSS 0.35%
CVE-2026-65617 Potential remote code execution on an Artifactory package service container.
CVSS 8.8 highEPSS 0.65%
CVE-2026-65924 Server-Side Request Forgery (SSRF) via Terraform Remote repository
CVSS 6.5 mediumEPSS 0.41%
CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
CVSS 6.5 mediumEPSS 0.40%
CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges
CVSS 8.8 highEPSS 0.37%
CVE-2026-66018 JFrog Artifactory build environment properties exposure
CVSS 6.5 mediumEPSS 0.45%
CVE-2026-66014 Potential authentication bypass leading to privilege escalation in Artifactory
CVSS 8.8 highEPSS 0.64%
CVE-2026-65921 Potential path traversal leading to unauthorized file writes
CVSS 8.8 highEPSS 0.59%
CVE-2026-42017 Privilege escalation via JFrog Worker event token exposure
CVSS 8.8 highEPSS 0.52%
CVE-2025-14830 JFrog Artifactory Cross-Site Scripting
CVSS 4.9 mediumEPSS 0.28%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)