jfrog artifactory
54 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-82329 | < 7.111.21 ; 7.117.0 – < 7.117.28 ; 7.125.0 – < 7.125.20 ; … | Potential authentication bypass leading to administrative access in Artifactory | CRITICAL 9.8 | 14 % | KEV | |
| CVE-2026-70550 | 7.161.0 – < 7.161.19 ; 7.146.0 – < 7.146.29 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactory | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-70548 | 7.161.11 – < 7.161.19 ; 7.146.0 – < 7.146.36 | SSRF In CocoaPods Via JFrog Artifactory External Dependency | LOW 3.5 | 0.3 % | ||
| CVE-2026-69104 | 7.161.0 – < 7.161.19 | Potential unauthorized repository migration in JFrog Artifactory | HIGH 7.6 | 0.3 % | ||
| CVE-2026-70551 | 7.161.0 – < 7.161.19 ; 7.146.0 – < 7.146.36 | Server-Side Request Forgery Via VCS remote download in JFrog Artifactory | HIGH 8.5 | 0.3 % | ||
| CVE-2026-69106 | < 7.146.28 | Potential cache poisoning in JFrog Artifactory | HIGH 8.8 | 0.5 % | ||
| CVE-2026-42018 | < 7.111.20 ; 7.117.0 – < 7.117.27 ; 7.125.0 – < 7.125.19 ; … | Anonymous user token generation exposure in JFrog Artifactory | HIGH 7.5 | 9.8 % | KEV | |
| CVE-2026-69107 | < 7.104.16 ; 7.111.0 – < 7.111.14 ; 7.117.0 – < 7.117.21 ; … | Potential unauthorized artifact access in JFrog Artifactory | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-69105 | 7.161.0 – < 7.161.16 | Potential package cache integrity issue in JFrog Artifactory | HIGH 8.1 | 0.2 % | ||
| CVE-2026-70547 | 7.161.0 – < 7.161.16 | Potential unauthorized metadata exposure in JFrog Artifactory | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-66016 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Rendered Artifactory Helm manifests may contain generated TLS private keys | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-68759 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Integration credential holders may impersonate users in JFrog Access | HIGH 7.2 | 0.3 % | ||
| CVE-2026-65926 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Private Release Bundle versions may be disclosed under specific configurations | LOW 3.1 | 0.2 % | ||
| CVE-2026-66384 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may write data outside the intended Docker cache path | MEDIUM 5.3 | 0.7 % | KEV | |
| CVE-2026-68758 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may access restricted Artifactory support information | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-66375 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Low-privilege users may remove protected Artifactory metadata | HIGH 8.1 | 0.4 % | ||
| CVE-2026-68757 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Potential improper SAML signature verification in JFrog Artifactory | HIGH 7.5 | 0.3 % | ||
| CVE-2026-68756 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Potential insecure deserialization in JFrog Artifactory | MEDIUM 6.6 | 0.5 % | ||
| CVE-2026-66382 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may write files outside the intended Artifactory work directory | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-66381 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Repository readers may access content outside configured upstream paths | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-68760 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Potential remember-me authentication bypass in JFrog Artifactory | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-66379 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may view private Puppet module metadata | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-66378 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may access private NuGet metadata | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-66377 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Anonymous users may access restricted Artifactory repository information | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-68755 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Bundle writers may alter trusted release information in JFrog Artifactory | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-66380 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Authenticated users may access private OCI referrer metadata | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-68754 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Publishers without delete permission can overwrite docker layer information | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-68753 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Anonymous users may access restricted Artifactory content under specific configurations | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-66376 | < 7.146.35 ; 7.161.0 – < 7.161.16 | Deleted users may temporarily retain access to JFrog Artifactory | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-68752 | < 7.146.35 | Project Resource Managers may escalate privileges in JFrog Artifactory | HIGH 7.2 | 0.5 % | ||
| CVE-2026-65922 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Potential unauthorized modification of Artifactory internal metadata | HIGH 7.1 | 0.3 % | ||
| CVE-2026-65923 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Potential server-side request forgery in Artifactory Ansible repository handling | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-65617 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Potential remote code execution on an Artifactory package service container. | HIGH 8.8 | 0.6 % | ||
| CVE-2026-65924 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Server-Side Request Forgery (SSRF) via Terraform Remote repository | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-65925 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-65616 | < 7.146.27 | Potential privilege escalation to JFrog administrator privileges | HIGH 8.8 | 0.4 % | ||
| CVE-2026-66015 | 7.146.0 – < 7.146.34 ; 7.161.0 – < 7.161.15 | JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. | HIGH 7.2 | 0.6 % | ||
| CVE-2026-65618 | < 7.133.6 | Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-66018 | 7.146.0 – < 7.146.34 ; 7.161.0 – < 7.161.15 | JFrog Artifactory build environment properties exposure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-66014 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Potential authentication bypass leading to privilege escalation in Artifactory | HIGH 8.8 | 0.6 % | ||
| CVE-2026-65921 | < 7.111.18 ; 7.117.0 – < 7.117.25 ; 7.125.0 – < 7.125.18 ; … | Potential path traversal leading to unauthorized file writes | HIGH 8.8 | 0.6 % | ||
| CVE-2026-42017 | < 7.133.21 ; 7.146.0 – < 7.146.8 | Privilege escalation via JFrog Worker event token exposure | HIGH 8.8 | 0.5 % | ||
| CVE-2026-42016 | < 7.133.11 | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | HIGH 8.8 | 8.6 % | KEV | |
| CVE-2024-6915 | < 7.90.6 ; < 7.84.20 ; < 7.77.14 ; … | JFrog Artifactory Cache Poisoning | CRITICAL 9.3 | 0.6 % | ||
| CVE-2024-2248 | < 7.85.0 ; < 7.84.7 | JFrog Artifactory Header Injection | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-4142 | < 7.84.6 ; < 7.77.11 ; 0 – < 7.71.21 ; … | JFrog Artifactory Improper input validation within token creation flow | CRITICAL 9.0 | 0.7 % | ||
| CVE-2024-2247 | < 7.77.7 ; < 7.82.1 | JFrog Artifactory Cross-Site Scripting | HIGH 8.8 | 0.5 % | ||
| CVE-2023-42509 | 7.17.4 – < 7.77.0 | JFrog Artifactory Sensitive Data Leakage in Repository configuration process | HIGH 7.5 | 0.4 % | ||
| CVE-2023-42661 | < 7.76.2 | JFrog Artifactory Improper input validation leads to arbitrary file write | HIGH 8.8 | 0.9 % | ||
| CVE-2023-42662 | 7.59 – < 7.59.18 ; 7.59 – < 7.63.18 ; 7.59 – < 7.68.19 ; … | JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens | CRITICAL 9.3 | 0.5 % | ||
| CVE-2023-42508 | 7.0.0 – < 7.66.0 | JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-41834 | 7.x – < 7.28.0 ; 6.x – < 6.23.38 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-p | MEDIUM 6.5 | 0.6 % | ||
| CVE-2021-45730 | 7.x – < 7.31.10 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Reposito | MEDIUM 6.0 | 0.6 % | ||
| CVE-2019-17444 | all – < 6.17.0 | JFrog Artifactory does not enforce default admin password change | CRITICAL 9.8 | 69 % |