JFrog vulnerabilities
65 CVEs and advisories name JFrog as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-68752Project Resource Managers may escalate privileges in JFrog Artifactory
- CVE-2026-65922Potential unauthorized modification of Artifactory internal metadata
- CVE-2026-65923Potential server-side request forgery in Artifactory Ansible repository handling
- CVE-2026-65617Potential remote code execution on an Artifactory package service container.
- CVE-2026-65924Server-Side Request Forgery (SSRF) via Terraform Remote repository
- CVE-2026-65925Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
- CVE-2026-65616Potential privilege escalation to JFrog administrator privileges
- CVE-2026-66015JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.
- CVE-2026-65618Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
- CVE-2026-66018JFrog Artifactory build environment properties exposure
- CVE-2026-66014Potential authentication bypass leading to privilege escalation in Artifactory
- CVE-2026-65921Potential path traversal leading to unauthorized file writes
- CVE-2026-42017Privilege escalation via JFrog Worker event token exposure
- CVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
- CVE-2025-14830JFrog Artifactory Cross-Site Scripting
- CVE-2024-6915JFrog Artifactory Cache Poisoning
- CVE-2024-2248JFrog Artifactory Header Injection
- CVE-2024-4142JFrog Artifactory Improper input validation within token creation flow
- CVE-2024-3505JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users
- CVE-2024-2247JFrog Artifactory Cross-Site Scripting
- CVE-2023-42509JFrog Artifactory Sensitive Data Leakage in Repository configuration process
- CVE-2023-42661JFrog Artifactory Improper input validation leads to arbitrary file write
- CVE-2023-42662JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
- CVE-2023-42508JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform
- CVE-2022-0668JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted r
- CVE-2021-23163JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints.
- CVE-2021-46687JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API.
- CVE-2021-45721JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameter
- CVE-2021-41834JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-p
- CVE-2021-45730JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Reposito