# cve.now: JFrog

The newest entries naming JFrog as an affected vendor (up to 200), of 65 in all, 4 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-92892](https://cve.now/CVE-2026-92892.md): Potential command execution on the host running JFrog CLI. (CVSS 9.0)
- [CVE-2026-82329](https://cve.now/CVE-2026-82329.md): Potential authentication bypass leading to administrative access in Artifactory (CVSS 9.8, KEV)
- [CVE-2026-70550](https://cve.now/CVE-2026-70550.md): Potential unauthorized access to private Composer repository metadata in JFrog Artifactory (CVSS 6.5)
- [CVE-2026-70548](https://cve.now/CVE-2026-70548.md): SSRF In CocoaPods Via JFrog Artifactory External Dependency (CVSS 3.5)
- [CVE-2026-69104](https://cve.now/CVE-2026-69104.md): Potential unauthorized repository migration in JFrog Artifactory (CVSS 7.6)
- [CVE-2026-70551](https://cve.now/CVE-2026-70551.md): Server-Side Request Forgery Via VCS remote download in JFrog Artifactory (CVSS 8.5)
- [CVE-2026-69106](https://cve.now/CVE-2026-69106.md): Potential cache poisoning in JFrog Artifactory (CVSS 8.8)
- [CVE-2026-42018](https://cve.now/CVE-2026-42018.md): Anonymous user token generation exposure in JFrog Artifactory (CVSS 7.5, KEV)
- [CVE-2026-69107](https://cve.now/CVE-2026-69107.md): Potential unauthorized artifact access in JFrog Artifactory (CVSS 5.9)
- [CVE-2026-69105](https://cve.now/CVE-2026-69105.md): Potential package cache integrity issue in JFrog Artifactory (CVSS 8.1)
- [CVE-2026-70547](https://cve.now/CVE-2026-70547.md): Potential unauthorized metadata exposure in JFrog Artifactory (CVSS 4.3)
- [CVE-2026-66016](https://cve.now/CVE-2026-66016.md): Rendered Artifactory Helm manifests may contain generated TLS private keys (CVSS 6.7)
- [CVE-2026-68759](https://cve.now/CVE-2026-68759.md): Integration credential holders may impersonate users in JFrog Access (CVSS 7.2)
- [CVE-2026-65926](https://cve.now/CVE-2026-65926.md): Private Release Bundle versions may be disclosed under specific configurations (CVSS 3.1)
- [CVE-2026-66384](https://cve.now/CVE-2026-66384.md): Authenticated users may write data outside the intended Docker cache path (CVSS 5.3, KEV)
- [CVE-2026-68758](https://cve.now/CVE-2026-68758.md): Authenticated users may access restricted Artifactory support information (CVSS 6.5)
- [CVE-2026-66375](https://cve.now/CVE-2026-66375.md): Low-privilege users may remove protected Artifactory metadata (CVSS 8.1)
- [CVE-2026-68757](https://cve.now/CVE-2026-68757.md): Potential improper SAML signature verification in JFrog Artifactory (CVSS 7.5)
- [CVE-2026-68756](https://cve.now/CVE-2026-68756.md): Potential insecure deserialization in JFrog Artifactory (CVSS 6.6)
- [CVE-2026-66382](https://cve.now/CVE-2026-66382.md): Authenticated users may write files outside the intended Artifactory work directory (CVSS 4.3)
- [CVE-2026-66381](https://cve.now/CVE-2026-66381.md): Repository readers may access content outside configured upstream paths (CVSS 5.3)
- [CVE-2026-68760](https://cve.now/CVE-2026-68760.md): Potential remember-me authentication bypass in JFrog Artifactory (CVSS 5.3)
- [CVE-2026-66379](https://cve.now/CVE-2026-66379.md): Authenticated users may view private Puppet module metadata (CVSS 4.3)
- [CVE-2026-66378](https://cve.now/CVE-2026-66378.md): Authenticated users may access private NuGet metadata (CVSS 4.3)
- [CVE-2026-66377](https://cve.now/CVE-2026-66377.md): Anonymous users may access restricted Artifactory repository information (CVSS 5.3)
- [CVE-2026-68755](https://cve.now/CVE-2026-68755.md): Bundle writers may alter trusted release information in JFrog Artifactory (CVSS 4.3)
- [CVE-2026-66380](https://cve.now/CVE-2026-66380.md): Authenticated users may access private OCI referrer metadata (CVSS 4.3)
- [CVE-2026-68754](https://cve.now/CVE-2026-68754.md): Publishers without delete permission can overwrite docker layer information (CVSS 6.5)
- [CVE-2026-68753](https://cve.now/CVE-2026-68753.md): Anonymous users may access restricted Artifactory content under specific configurations (CVSS 5.3)
- [CVE-2026-66376](https://cve.now/CVE-2026-66376.md): Deleted users may temporarily retain access to JFrog Artifactory (CVSS 4.2)
- [CVE-2026-68752](https://cve.now/CVE-2026-68752.md): Project Resource Managers may escalate privileges in JFrog Artifactory (CVSS 7.2)
- [CVE-2026-65922](https://cve.now/CVE-2026-65922.md): Potential unauthorized modification of Artifactory internal metadata (CVSS 7.1)
- [CVE-2026-65923](https://cve.now/CVE-2026-65923.md): Potential server-side request forgery in Artifactory Ansible repository handling (CVSS 6.8)
- [CVE-2026-65617](https://cve.now/CVE-2026-65617.md): Potential remote code execution on an Artifactory package service container. (CVSS 8.8)
- [CVE-2026-65924](https://cve.now/CVE-2026-65924.md): Server-Side Request Forgery (SSRF) via Terraform Remote repository (CVSS 6.5)
- [CVE-2026-65925](https://cve.now/CVE-2026-65925.md): Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository (CVSS 6.5)
- [CVE-2026-65616](https://cve.now/CVE-2026-65616.md): Potential privilege escalation to JFrog administrator privileges (CVSS 8.8)
- [CVE-2026-66015](https://cve.now/CVE-2026-66015.md): JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. (CVSS 7.2)
- [CVE-2026-65618](https://cve.now/CVE-2026-65618.md): Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability (CVSS 6.5)
- [CVE-2026-66018](https://cve.now/CVE-2026-66018.md): JFrog Artifactory build environment properties exposure (CVSS 6.5)
- [CVE-2026-66014](https://cve.now/CVE-2026-66014.md): Potential authentication bypass leading to privilege escalation in Artifactory (CVSS 8.8)
- [CVE-2026-65921](https://cve.now/CVE-2026-65921.md): Potential path traversal leading to unauthorized file writes (CVSS 8.8)
- [CVE-2026-42017](https://cve.now/CVE-2026-42017.md): Privilege escalation via JFrog Worker event token exposure (CVSS 8.8)
- [CVE-2026-42016](https://cve.now/CVE-2026-42016.md): Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation (CVSS 8.1, KEV)
- [CVE-2025-14830](https://cve.now/CVE-2025-14830.md): JFrog Artifactory Cross-Site Scripting (CVSS 4.9)
- [CVE-2024-6915](https://cve.now/CVE-2024-6915.md): JFrog Artifactory Cache Poisoning (CVSS 9.3)
- [CVE-2024-2248](https://cve.now/CVE-2024-2248.md): JFrog Artifactory Header Injection (CVSS 6.4)
- [CVE-2024-4142](https://cve.now/CVE-2024-4142.md): JFrog Artifactory Improper input validation within token creation flow (CVSS 9.0)
- [CVE-2024-3505](https://cve.now/CVE-2024-3505.md): JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users (CVSS 4.3)
- [CVE-2024-2247](https://cve.now/CVE-2024-2247.md): JFrog Artifactory Cross-Site Scripting (CVSS 8.8)
- [CVE-2023-42509](https://cve.now/CVE-2023-42509.md): JFrog Artifactory Sensitive Data Leakage in Repository configuration process (CVSS 6.6)
- [CVE-2023-42661](https://cve.now/CVE-2023-42661.md): JFrog Artifactory Improper input validation leads to arbitrary file write (CVSS 7.2)
- [CVE-2023-42662](https://cve.now/CVE-2023-42662.md): JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens (CVSS 9.3)
- [CVE-2023-42508](https://cve.now/CVE-2023-42508.md): JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform (CVSS 6.5)
- [CVE-2022-0668](https://cve.now/CVE-2022-0668.md): JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted r (CVSS 5.3)
- [CVE-2021-23163](https://cve.now/CVE-2021-23163.md): JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. (CVSS 3.1)
- [CVE-2021-46687](https://cve.now/CVE-2021-46687.md): JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. (CVSS 4.9)
- [CVE-2021-45721](https://cve.now/CVE-2021-45721.md): JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameter (CVSS 6.1)
- [CVE-2021-41834](https://cve.now/CVE-2021-41834.md): JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-p (CVSS 5.3)
- [CVE-2021-45730](https://cve.now/CVE-2021-45730.md): JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Reposito (CVSS 6.0)
- [CVE-2022-0573](https://cve.now/CVE-2022-0573.md): JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Es (CVSS 8.8)
- [CVE-2021-46270](https://cve.now/CVE-2021-46270.md): JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository (CVSS 2.7)
- [CVE-2021-45074](https://cve.now/CVE-2021-45074.md): JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known use (CVSS 4.3)
- [CVE-2021-3860](https://cve.now/CVE-2021-3860.md): JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user (CVSS 8.8)
- [CVE-2019-17444](https://cve.now/CVE-2019-17444.md): JFrog Artifactory does not enforce default admin password change (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jfrog
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.