CVE-2026-69106 | High | 8.8 | 2026-08-12 | A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. |
CVE-2026-42018 | High | 7.5 | 2026-08-12 | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive… |
CVE-2026-70547 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access package metadata under specific conditions. |
CVE-2026-69107 | Medium | 5.9 | 2026-08-12 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. |
CVE-2026-69105 | High | 8.1 | 2026-08-12 | An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabili… |
CVE-2026-68759 | High | 7.2 | 2026-08-12 | A holder of a valid integration credential may impersonate other users under specific conditions. |
CVE-2026-68758 | Medium | 6.5 | 2026-08-12 | A low-privileged authenticated user may access restricted support information under specific conditions. |
CVE-2026-66384 | Medium | 5.3 | 2026-08-12 | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. |
CVE-2026-66016 | Medium | 6.7 | 2026-08-12 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. |
CVE-2026-65926 | Low | 3.1 | 2026-08-12 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundl… |
CVE-2026-68760 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may bypass authentication under specific cache conditions. |
CVE-2026-68757 | High | 7.5 | 2026-08-12 | A user with access to a valid SAML response may impersonate another user under specific conditions. |
CVE-2026-68756 | Medium | 6.6 | 2026-08-12 | A party with write access to stored session data may affect JFrog Artifactory under specific conditions. |
CVE-2026-68755 | Medium | 4.3 | 2026-08-12 | A bundle writer may create misleading release promotion information under specific conditions. |
CVE-2026-68754 | Medium | 6.5 | 2026-08-12 | A repository publisher without delete permission may modify protected package content under specific conditions. |
CVE-2026-68753 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. |
CVE-2026-68752 | High | 7.2 | 2026-08-12 | A Project Resource Manager may gain broader administrative privileges under specific conditions. |
CVE-2026-66382 | Medium | 4.3 | 2026-08-12 | An authenticated user may write files outside the intended Artifactory work directory under specific conditions. |
CVE-2026-66381 | Medium | 5.3 | 2026-08-12 | A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. |
CVE-2026-66380 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. |
CVE-2026-66379 | Medium | 4.3 | 2026-08-12 | An authenticated user may view private Puppet module metadata without repository read access. |
CVE-2026-66378 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private NuGet metadata under specific conditions. |
CVE-2026-66377 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted repository information under specific conditions. |
CVE-2026-66376 | Medium | 4.2 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. |
CVE-2026-66375 | High | 8.1 | 2026-08-12 | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. |
CVE-2026-66018 | Medium | 6.5 | 2026-07-27 | Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository para… |
CVE-2026-66015 | High | 7.2 | 2026-07-27 | An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may… |
CVE-2026-66014 | High | 8.8 | 2026-07-27 | JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalat… |
CVE-2026-65925 | Medium | 6.5 | 2026-07-27 | A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. |
CVE-2026-65924 | Medium | 6.5 | 2026-07-27 | JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if a… |
CVE-2026-65923 | Medium | 6.8 | 2026-07-27 | A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended… |
CVE-2026-65922 | High | 7.1 | 2026-07-27 | An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal met… |
CVE-2026-65921 | High | 8.8 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts loca… |
CVE-2026-65618 | Medium | 6.5 | 2026-07-27 | Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potent… |
CVE-2026-65617 | High | 8.8 | 2026-07-27 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under… |
CVE-2026-65616 | High | 8.8 | 2026-07-27 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. |
CVE-2026-42017 | High | 8.8 | 2026-07-27 | An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. |
CVE-2026-42016 | High | 8.1 | 2026-07-27 | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issue… |
CVE-2025-14830 | Medium | 4.9 | 2026-01-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scri… |
CVE-2024-6915 | Critical | 9.3 | 2024-08-05 | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could p… |
CVE-2024-2248 | Medium | 6.4 | 2024-05-15 | A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end us… |
CVE-2024-4142 | Critical | 9.0 | 2024-05-01 | An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory.
Due to this vulnerability… |
CVE-2024-3505 | Medium | 4.3 | 2024-04-15 | JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read th… |
CVE-2024-2247 | High | 8.8 | 2024-03-13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |
CVE-2023-42661 | High | 7.2 | 2024-03-07 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specia… |
CVE-2023-42509 | Medium | 6.6 | 2024-03-07 | JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in reposi… |
CVE-2023-42662 | Critical | 9.3 | 2024-03-07 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially craft… |
CVE-2023-42508 | Medium | 6.5 | 2023-10-03 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users be… |
CVE-2022-0668 | Medium | 5.3 | 2023-01-08 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by a… |
CVE-2021-46687 | Medium | 4.9 | 2022-07-06 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects… |
CVE-2021-45721 | Medium | 6.1 | 2022-07-06 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API… |
CVE-2021-23163 | Low | 3.1 | 2022-07-06 | JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JF… |
CVE-2021-41834 | Medium | 5.3 | 2022-05-23 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to r… |
CVE-2021-45730 | Medium | 6.0 | 2022-05-19 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Re… |
CVE-2022-0573 | High | 8.8 | 2022-05-16 | JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote… |
CVE-2021-46270 | Low | 2.7 | 2022-03-02 | JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insuf… |
CVE-2021-45074 | Medium | 4.3 | 2022-03-02 | JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, whi… |
CVE-2021-3860 | High | 8.8 | 2021-12-20 | JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete v… |
CVE-2019-17444 | Critical | 9.8 | 2020-10-12 | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorize… |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2020-2164 | Medium | 6.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it… |
CVE-2019-19937 | High | 7.2 | 2020-03-16 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "un… |
CVE-2020-7931 | High | 8.8 | 2020-01-23 | In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patch… |
CVE-2019-10324 | Medium | 6.5 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenRe… |
CVE-2019-10323 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access t… |
CVE-2019-10322 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Rea… |
CVE-2019-10321 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users… |
CVE-2018-19971 | Critical | 9.8 | 2019-04-16 | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control. |
CVE-2019-9733 | Critical | 9.8 | 2019-04-11 | An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administ… |
CVE-2018-1000424 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.jav… |
CVE-2018-1000206 | High | 8.8 | 2018-07-13 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allo… |
CVE-2018-1000623 | High | 7.2 | 2018-07-09 | JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" fe… |
CVE-2016-10036 | Critical | 9.8 | 2018-05-01 | Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet applic… |
CVE-2016-6501 | Critical | 9.8 | 2016-12-09 | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poi… |