Browse CVEs

MEDIUM 6.5 CVE-2026-66018 Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repos… Artifactory 7.146.34 / 7.161.15+ Fix from $1,6002026-07-27 CRITICAL 9.8 CVE-2026-66014 JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker … Artifactory 7.111.18 / 7.117.25+ Fix from $2,3002026-07-27 HIGH 8.8 CVE-2026-65921 A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build arti… Artifactory 7.111.18 / 7.117.25+ Fix from $1,9502026-07-27 HIGH 7.2 CVE-2026-66015 An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploit… Artifactory 7.146.34 / 7.161.15+ Fix from $1,9502026-07-27 MEDIUM 6.8 CVE-2026-65923 A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause … Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-65618 Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifacto… Artifactory 7.133.6+ Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-65924 JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user … Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-65925 A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-65922 An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted in… Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-65616 Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. Artifactory 7.146.27+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-65617 A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availabi… Artifactory 7.111.18 / 7.117.25+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-42016 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signa… Artifactory 7.133.11+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-42017 An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. Artifactory 7.133.21 / 7.146.8+ Fix from $1,9502026-07-27 MEDIUM 6.1 CVE-2024-2247 JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mec… Artifactory after 7.77.7 Fix from $1,6002024-03-13 HIGH 8.8 CVE-2023-42661 JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution whe… Artifactory 7.76.2+ Fix from $1,9502024-03-07 HIGH 7.5 CVE-2023-42509 JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions… Artifactory 7.77.0+ Fix from $1,9502024-03-07 MEDIUM 6.5 CVE-2023-42662 JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with speci… Artifactory 7.59.18 / 7.63.18+ Fix from $1,6002024-03-07 MEDIUM 6.5 CVE-2023-42508 JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticate… Artifactory 7.66.0+ Fix from $1,6002023-10-03 CRITICAL 9.8 CVE-2022-0668 JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is… Artifactory 6.23.41 / 7.37.13+ Fix from $2,3002023-01-08 HIGH 8.8 CVE-2021-23163 JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects… Artifactory 6.23.38 / 7.33.6+ Fix from $1,9502022-07-06 MEDIUM 6.1 CVE-2021-45721 JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in User… Artifactory 6.23.38 / 7.29.8+ Fix from $1,6002022-07-06 MEDIUM 6.5 CVE-2021-41834 JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged… Artifactory 6.23.38 / 7.28.0+ Fix from $1,6002022-05-23 HIGH 8.8 CVE-2022-0573 JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation … Artifactory 6.23.41 / 7.17.16+ Fix from $1,9502022-05-16 MEDIUM 5.4 CVE-2021-45074 JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth … Artifactory 6.23.38 / 7.29.3+ Fix from $1,6002022-03-02 HIGH 8.8 CVE-2021-3860 JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to in… Artifactory 6.23.30 / 7.11.8+ Fix from $1,9502021-12-20 CRITICAL 9.8 CVE-2019-17444EPSS 69% Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow u… Artifactory 6.17.0+ Fix from $2,3002020-10-12 HIGH 7.5 CVE-2020-2165 Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potential… Artifactory after 3.6.0 Fix from $1,9502020-03-25 MEDIUM 6.5 CVE-2020-2164 Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins maste… Artifactory after 3.5.0 Fix from $1,6002020-03-25 HIGH 7.2 CVE-2019-19937 In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can l… Artifactory 6.18+ Fix from $1,9502020-03-16 HIGH 8.8 CVE-2020-7931EPSS 5% In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys f… Artifactory 5.11.8 / 6.1.6+ Fix from $1,9502020-01-23