Jfrog Artifactory
78 CVEs affecting Jfrog Artifactory. Latest disclosed: 2026-08-28. Critical: 9, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82329 | Critical | 9.8 | 2026-08-28 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain ad… |
CVE-2019-17444 | Critical | 9.8 | 2020-10-12 | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorize… |
CVE-2018-19971 | Critical | 9.8 | 2019-04-16 | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control. |
CVE-2019-9733 | Critical | 9.8 | 2019-04-11 | An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administ… |
CVE-2016-10036 | Critical | 9.8 | 2018-05-01 | Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet applic… |
CVE-2016-6501 | Critical | 9.8 | 2016-12-09 | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poi… |
CVE-2024-6915 | Critical | 9.3 | 2024-08-05 | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could p… |
CVE-2023-42662 | Critical | 9.3 | 2024-03-07 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially craft… |
CVE-2024-4142 | Critical | 9.0 | 2024-05-01 | An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability… |
CVE-2026-69106 | High | 8.8 | 2026-08-12 | A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. |
CVE-2026-66014 | High | 8.8 | 2026-07-27 | JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalat… |
CVE-2026-65921 | High | 8.8 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts loca… |
CVE-2026-65617 | High | 8.8 | 2026-07-27 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under… |
CVE-2026-65616 | High | 8.8 | 2026-07-27 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. |
CVE-2026-42017 | High | 8.8 | 2026-07-27 | An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. |
CVE-2024-2247 | High | 8.8 | 2024-03-13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |
CVE-2022-0573 | High | 8.8 | 2022-05-16 | JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote… |
CVE-2021-3860 | High | 8.8 | 2021-12-20 | JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete v… |
CVE-2020-7931 | High | 8.8 | 2020-01-23 | In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patch… |
CVE-2018-1000206 | High | 8.8 | 2018-07-13 | JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allo… |