# JFrog CVEs > JFrog: 45 CVEs mapped to its software or packages (4 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/jfrog/cves Last updated: 2026-10-13T17:47:43Z 45 CVEs map to JFrog (4 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [JFrog](https://rewindex.com/company/jfrog.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that JFrog’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-13 | [CVE-2026-92892](https://rewindex.com/cve/CVE-2026-92892.md) | Potential command execution on the host running JFrog CLI. | 9.0 critical | | | 2026-08-12 | [CVE-2026-42018](https://rewindex.com/cve/CVE-2026-42018.md) | Anonymous user token generation exposure in JFrog Artifactory | 7.5 high | yes (2026-09-11) | | 2026-07-27 | [CVE-2026-42016](https://rewindex.com/cve/CVE-2026-42016.md) | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | 8.1 high | yes (2026-09-11) | | 2026-08-28 | [CVE-2026-82329](https://rewindex.com/cve/CVE-2026-82329.md) | Potential authentication bypass leading to administrative access in Artifactory | 9.8 critical | yes (2026-09-02) | | 2026-08-12 | [CVE-2026-66384](https://rewindex.com/cve/CVE-2026-66384.md) | Authenticated users may write data outside the intended Docker cache path | 5.3 medium | yes (2026-08-27) | | 2026-08-25 | [CVE-2026-70550](https://rewindex.com/cve/CVE-2026-70550.md) | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory | 6.5 medium | | | 2026-08-25 | [CVE-2026-70548](https://rewindex.com/cve/CVE-2026-70548.md) | SSRF In CocoaPods Via JFrog Artifactory External Dependency | 3.5 low | | | 2026-08-25 | [CVE-2026-69104](https://rewindex.com/cve/CVE-2026-69104.md) | Potential unauthorized repository migration in JFrog Artifactory | 7.6 high | | | 2026-08-25 | [CVE-2026-70551](https://rewindex.com/cve/CVE-2026-70551.md) | Server-Side Request Forgery Via VCS remote download in JFrog Artifactory | 8.5 high | | | 2026-08-12 | [CVE-2026-69106](https://rewindex.com/cve/CVE-2026-69106.md) | Potential cache poisoning in JFrog Artifactory | 8.8 high | | | 2026-08-12 | [CVE-2026-69107](https://rewindex.com/cve/CVE-2026-69107.md) | Potential unauthorized artifact access in JFrog Artifactory | 5.9 medium | | | 2026-08-12 | [CVE-2026-69105](https://rewindex.com/cve/CVE-2026-69105.md) | Potential package cache integrity issue in JFrog Artifactory | 8.1 high | | | 2026-08-12 | [CVE-2026-70547](https://rewindex.com/cve/CVE-2026-70547.md) | Potential unauthorized metadata exposure in JFrog Artifactory | 4.3 medium | | | 2026-08-12 | [CVE-2026-66016](https://rewindex.com/cve/CVE-2026-66016.md) | Rendered Artifactory Helm manifests may contain generated TLS private keys | 6.7 medium | | | 2026-08-12 | [CVE-2026-68759](https://rewindex.com/cve/CVE-2026-68759.md) | Integration credential holders may impersonate users in JFrog Access | 7.2 high | | | 2026-08-12 | [CVE-2026-65926](https://rewindex.com/cve/CVE-2026-65926.md) | Private Release Bundle versions may be disclosed under specific configurations | 3.1 low | | | 2026-08-12 | [CVE-2026-68758](https://rewindex.com/cve/CVE-2026-68758.md) | Authenticated users may access restricted Artifactory support information | 6.5 medium | | | 2026-08-12 | [CVE-2026-66375](https://rewindex.com/cve/CVE-2026-66375.md) | Low-privilege users may remove protected Artifactory metadata | 8.1 high | | | 2026-08-12 | [CVE-2026-68757](https://rewindex.com/cve/CVE-2026-68757.md) | Potential improper SAML signature verification in JFrog Artifactory | 7.5 high | | | 2026-08-12 | [CVE-2026-68756](https://rewindex.com/cve/CVE-2026-68756.md) | Potential insecure deserialization in JFrog Artifactory | 6.6 medium | | | 2026-08-12 | [CVE-2026-66382](https://rewindex.com/cve/CVE-2026-66382.md) | Authenticated users may write files outside the intended Artifactory work directory | 4.3 medium | | | 2026-08-12 | [CVE-2026-66381](https://rewindex.com/cve/CVE-2026-66381.md) | Repository readers may access content outside configured upstream paths | 5.3 medium | | | 2026-08-12 | [CVE-2026-68760](https://rewindex.com/cve/CVE-2026-68760.md) | Potential remember-me authentication bypass in JFrog Artifactory | 5.3 medium | | | 2026-08-12 | [CVE-2026-66379](https://rewindex.com/cve/CVE-2026-66379.md) | Authenticated users may view private Puppet module metadata | 4.3 medium | | | 2026-08-12 | [CVE-2026-66378](https://rewindex.com/cve/CVE-2026-66378.md) | Authenticated users may access private NuGet metadata | 4.3 medium | | | 2026-08-12 | [CVE-2026-66377](https://rewindex.com/cve/CVE-2026-66377.md) | Anonymous users may access restricted Artifactory repository information | 5.3 medium | | | 2026-08-12 | [CVE-2026-68755](https://rewindex.com/cve/CVE-2026-68755.md) | Bundle writers may alter trusted release information in JFrog Artifactory | 4.3 medium | | | 2026-08-12 | [CVE-2026-66380](https://rewindex.com/cve/CVE-2026-66380.md) | Authenticated users may access private OCI referrer metadata | 4.3 medium | | | 2026-08-12 | [CVE-2026-68754](https://rewindex.com/cve/CVE-2026-68754.md) | Publishers without delete permission can overwrite docker layer information | 6.5 medium | | | 2026-08-12 | [CVE-2026-68753](https://rewindex.com/cve/CVE-2026-68753.md) | Anonymous users may access restricted Artifactory content under specific configurations | 5.3 medium | | | 2026-08-12 | [CVE-2026-66376](https://rewindex.com/cve/CVE-2026-66376.md) | Deleted users may temporarily retain access to JFrog Artifactory | 4.2 medium | | | 2026-08-12 | [CVE-2026-68752](https://rewindex.com/cve/CVE-2026-68752.md) | Project Resource Managers may escalate privileges in JFrog Artifactory | 7.2 high | | | 2026-07-27 | [CVE-2026-65922](https://rewindex.com/cve/CVE-2026-65922.md) | Potential unauthorized modification of Artifactory internal metadata | 7.1 high | | | 2026-07-27 | [CVE-2026-65923](https://rewindex.com/cve/CVE-2026-65923.md) | Potential server-side request forgery in Artifactory Ansible repository handling | 6.8 medium | | | 2026-07-27 | [CVE-2026-65617](https://rewindex.com/cve/CVE-2026-65617.md) | Potential remote code execution on an Artifactory package service container. | 8.8 high | | | 2026-07-27 | [CVE-2026-65924](https://rewindex.com/cve/CVE-2026-65924.md) | Server-Side Request Forgery (SSRF) via Terraform Remote repository | 6.5 medium | | | 2026-07-27 | [CVE-2026-65925](https://rewindex.com/cve/CVE-2026-65925.md) | Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository | 6.5 medium | | | 2026-07-27 | [CVE-2026-65616](https://rewindex.com/cve/CVE-2026-65616.md) | Potential privilege escalation to JFrog administrator privileges | 8.8 high | | | 2026-07-27 | [CVE-2026-66015](https://rewindex.com/cve/CVE-2026-66015.md) | JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. | 7.2 high | | | 2026-07-27 | [CVE-2026-65618](https://rewindex.com/cve/CVE-2026-65618.md) | Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability | 6.5 medium | | | 2026-07-27 | [CVE-2026-66018](https://rewindex.com/cve/CVE-2026-66018.md) | JFrog Artifactory build environment properties exposure | 6.5 medium | | | 2026-07-27 | [CVE-2026-66014](https://rewindex.com/cve/CVE-2026-66014.md) | Potential authentication bypass leading to privilege escalation in Artifactory | 8.8 high | | | 2026-07-27 | [CVE-2026-65921](https://rewindex.com/cve/CVE-2026-65921.md) | Potential path traversal leading to unauthorized file writes | 8.8 high | | | 2026-07-27 | [CVE-2026-42017](https://rewindex.com/cve/CVE-2026-42017.md) | Privilege escalation via JFrog Worker event token exposure | 8.8 high | | | 2026-01-04 | [CVE-2025-14830](https://rewindex.com/cve/CVE-2025-14830.md) | JFrog Artifactory Cross-Site Scripting | 4.9 medium | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (JFrog) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 8 | 5 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 7 | 17 | 1 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 1 | 2 | 1 | 1 | 0 | 1 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 2 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/jfrog/cves · Markdown: https://rewindex.com/company/jfrog/cves.md · JSON: https://rewindex.com/api/v1/companies/jfrog/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:48:19.778Z