PatchTheCEVCVEs published by JFrog
CVEs published by JFrog (CVE Numbering Authority). 28 tracked.
- CVE-2026-66384 MEDIUM 5.3 EXPLOITED UPGRADE JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- CVE-2026-66375 HIGH 8.1 UPGRADE A low-privilege authenticated user may permanently remove protected internal metadata across repositories unde
- CVE-2026-68752 HIGH 7.2 UPGRADE A Project Resource Manager may gain broader administrative privileges under specific conditions.
- CVE-2026-69107 MEDIUM 5.9 UPGRADE An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
- CVE-2026-68756 MEDIUM 6.6 UPGRADE A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
- CVE-2026-68760 MEDIUM 5.3 UPGRADE An unauthenticated user may bypass authentication under specific cache conditions.
- CVE-2026-66377 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted repository information under specific conditions.
- CVE-2026-68757 HIGH 7.5 UPGRADE A user with access to a valid SAML response may impersonate another user under specific conditions.
- CVE-2026-68759 HIGH 7.2 UPGRADE A holder of a valid integration credential may impersonate other users under specific conditions.
- CVE-2026-69105 HIGH 8.1 UPGRADE An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potent
- CVE-2026-68758 MEDIUM 6.5 UPGRADE A low-privileged authenticated user may access restricted support information under specific conditions.
- CVE-2026-68754 MEDIUM 6.5 UPGRADE A repository publisher without delete permission may modify protected package content under specific condition
- CVE-2026-66381 MEDIUM 5.3 UPGRADE A repository reader with cache-deploy permission may access content outside a configured upstream path under s
- CVE-2026-68753 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is con
- CVE-2026-66016 MEDIUM 6.7 UPGRADE Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifes
- CVE-2026-66382 MEDIUM 4.3 UPGRADE An authenticated user may write files outside the intended Artifactory work directory under specific condition
- CVE-2026-66378 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private NuGet metadata under specific cond
- CVE-2026-66379 MEDIUM 4.3 UPGRADE An authenticated user may view private Puppet module metadata without repository read access.
- CVE-2026-66380 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private OCI referrer metadata under specif
- CVE-2026-70547 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access package metadata under specific conditions
- CVE-2026-68755 MEDIUM 4.3 UPGRADE A bundle writer may create misleading release promotion information under specific conditions.
- CVE-2026-66376 MEDIUM 4.2 UPGRADE Credentials for a deleted user may remain valid for a short period under specific conditions.
- CVE-2026-65926 LOW 3.1 An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private
- CVE-2026-42018 HIGH 7.5 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
- CVE-2026-69106 HIGH 8.8 UPGRADE A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consu
- CVE-2026-92892 CRITICAL 9.0 Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions
- CVE-2026-42016 HIGH 8.1 EXPLOITED UPGRADE JFrog Artifactory Incorrect Authorization Vulnerability
- CVE-2026-82329 CRITICAL 9.8 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability