JFrog vulnerabilities
65 CVEs and advisories name JFrog as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-92892Potential command execution on the host running JFrog CLI.
- CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactory
- CVE-2026-70550Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
- CVE-2026-70548SSRF In CocoaPods Via JFrog Artifactory External Dependency
- CVE-2026-69104Potential unauthorized repository migration in JFrog Artifactory
- CVE-2026-70551Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
- CVE-2026-69106Potential cache poisoning in JFrog Artifactory
- CVE-2026-42018Anonymous user token generation exposure in JFrog Artifactory
- CVE-2026-69107Potential unauthorized artifact access in JFrog Artifactory
- CVE-2026-69105Potential package cache integrity issue in JFrog Artifactory
- CVE-2026-70547Potential unauthorized metadata exposure in JFrog Artifactory
- CVE-2026-66016Rendered Artifactory Helm manifests may contain generated TLS private keys
- CVE-2026-68759Integration credential holders may impersonate users in JFrog Access
- CVE-2026-65926Private Release Bundle versions may be disclosed under specific configurations
- CVE-2026-66384Authenticated users may write data outside the intended Docker cache path
- CVE-2026-68758Authenticated users may access restricted Artifactory support information
- CVE-2026-66375Low-privilege users may remove protected Artifactory metadata
- CVE-2026-68757Potential improper SAML signature verification in JFrog Artifactory
- CVE-2026-68756Potential insecure deserialization in JFrog Artifactory
- CVE-2026-66382Authenticated users may write files outside the intended Artifactory work directory
- CVE-2026-66381Repository readers may access content outside configured upstream paths
- CVE-2026-68760Potential remember-me authentication bypass in JFrog Artifactory
- CVE-2026-66379Authenticated users may view private Puppet module metadata
- CVE-2026-66378Authenticated users may access private NuGet metadata
- CVE-2026-66377Anonymous users may access restricted Artifactory repository information
- CVE-2026-68755Bundle writers may alter trusted release information in JFrog Artifactory
- CVE-2026-66380Authenticated users may access private OCI referrer metadata
- CVE-2026-68754Publishers without delete permission can overwrite docker layer information
- CVE-2026-68753Anonymous users may access restricted Artifactory content under specific configurations
- CVE-2026-66376Deleted users may temporarily retain access to JFrog Artifactory