CVEs for JFrog
45 matching vulnerabilities, 4 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-92892 Potential command execution on the host running JFrog CLI.
CVSS 9.0 criticalEPSS 0.34%JFrog
CVE-2026-42018 Anonymous user token generation exposure in JFrog Artifactory
CVSS 7.5 highKEV added EPSS 9.8%JFrog
CVE-2026-42016 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
CVSS 8.1 highKEV added EPSS 8.6%JFrog
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
CVSS 9.8 criticalKEV added EPSS 14.4%JFrog
CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path
CVSS 5.3 mediumKEV added EPSS 0.66%JFrog
CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency
CVSS 3.5 lowEPSS 0.29%JFrog
CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory
CVSS 7.6 highEPSS 0.31%JFrog
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
CVSS 8.5 highEPSS 0.30%JFrog
CVE-2026-69106 Potential cache poisoning in JFrog Artifactory
CVSS 8.8 highEPSS 0.52%JFrog
CVE-2026-69107 Potential unauthorized artifact access in JFrog Artifactory
CVSS 5.9 mediumEPSS 0.41%JFrog
CVE-2026-69105 Potential package cache integrity issue in JFrog Artifactory
CVSS 8.1 highEPSS 0.22%JFrog
CVE-2026-70547 Potential unauthorized metadata exposure in JFrog Artifactory
CVSS 4.3 mediumEPSS 0.28%JFrog
CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys
CVSS 6.7 mediumEPSS 0.12%JFrog
CVE-2026-68759 Integration credential holders may impersonate users in JFrog Access
CVSS 7.2 highEPSS 0.33%JFrog
CVE-2026-68758 Authenticated users may access restricted Artifactory support information
CVSS 6.5 mediumEPSS 0.35%JFrog
CVE-2026-66375 Low-privilege users may remove protected Artifactory metadata
CVSS 8.1 highEPSS 0.40%JFrog
CVE-2026-68757 Potential improper SAML signature verification in JFrog Artifactory
CVSS 7.5 highEPSS 0.26%JFrog
CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory
CVSS 6.6 mediumEPSS 0.47%JFrog
CVE-2026-66382 Authenticated users may write files outside the intended Artifactory work directory
CVSS 4.3 mediumEPSS 0.35%JFrog
CVE-2026-66381 Repository readers may access content outside configured upstream paths
CVSS 5.3 mediumEPSS 0.38%JFrog
CVE-2026-68760 Potential remember-me authentication bypass in JFrog Artifactory
CVSS 5.3 mediumEPSS 0.46%JFrog
CVE-2026-66379 Authenticated users may view private Puppet module metadata
CVSS 4.3 mediumEPSS 0.30%JFrog
CVE-2026-66378 Authenticated users may access private NuGet metadata
CVSS 4.3 mediumEPSS 0.30%JFrog
CVE-2026-66377 Anonymous users may access restricted Artifactory repository information
CVSS 5.3 mediumEPSS 0.36%JFrog
CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory
CVSS 4.3 mediumEPSS 0.26%JFrog
CVE-2026-66380 Authenticated users may access private OCI referrer metadata
CVSS 4.3 mediumEPSS 0.30%JFrog
CVE-2026-68754 Publishers without delete permission can overwrite docker layer information
CVSS 6.5 mediumEPSS 0.31%JFrog
CVE-2026-66376 Deleted users may temporarily retain access to JFrog Artifactory
CVSS 4.2 mediumEPSS 0.22%JFrog
CVE-2026-68752 Project Resource Managers may escalate privileges in JFrog Artifactory
CVSS 7.2 highEPSS 0.49%JFrog
CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata
CVSS 7.1 highEPSS 0.34%JFrog
CVE-2026-65923 Potential server-side request forgery in Artifactory Ansible repository handling
CVSS 6.8 mediumEPSS 0.35%JFrog
CVE-2026-65617 Potential remote code execution on an Artifactory package service container.
CVSS 8.8 highEPSS 0.65%JFrog
CVE-2026-65924 Server-Side Request Forgery (SSRF) via Terraform Remote repository
CVSS 6.5 mediumEPSS 0.41%JFrog
CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
CVSS 6.5 mediumEPSS 0.40%JFrog
CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges
CVSS 8.8 highEPSS 0.37%JFrog
CVE-2026-66018 JFrog Artifactory build environment properties exposure
CVSS 6.5 mediumEPSS 0.45%JFrog
CVE-2026-65921 Potential path traversal leading to unauthorized file writes
CVSS 8.8 highEPSS 0.59%JFrog
CVE-2026-42017 Privilege escalation via JFrog Worker event token exposure
CVSS 8.8 highEPSS 0.52%JFrog
CVE-2025-14830 JFrog Artifactory Cross-Site Scripting
CVSS 4.9 mediumEPSS 0.28%JFrog
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)