# jfrog artifactory.

Every CVE that names jfrog artifactory among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Potential authentication bypass leading to administrative access in Artifactory](https://agentprime.io/advisories/CVE-2026-82329.md)
  `CVE-2026-82329` · CVE record: jfrog artifactory · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.14 · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Potential unauthorized access to private Composer repository metadata in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-70550.md)
  `CVE-2026-70550` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [SSRF In CocoaPods Via JFrog Artifactory External Dependency](https://agentprime.io/advisories/CVE-2026-70548.md)
  `CVE-2026-70548` · CVE record: jfrog artifactory · CVSS 3.5 Low · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Potential unauthorized repository migration in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-69104.md)
  `CVE-2026-69104` · CVE record: jfrog artifactory · CVSS 7.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Server-Side Request Forgery Via VCS remote download in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-70551.md)
  `CVE-2026-70551` · CVE record: jfrog artifactory · CVSS 8.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Potential cache poisoning in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-69106.md)
  `CVE-2026-69106` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-20
- [Anonymous user token generation exposure in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-42018.md)
  `CVE-2026-42018` · CVE record: jfrog artifactory · CVSS 7.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 12 Aug 2026 · Tags: Authentication bypass
- [Potential unauthorized artifact access in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-69107.md)
  `CVE-2026-69107` · CVE record: jfrog artifactory · CVSS 5.9 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Potential package cache integrity issue in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-69105.md)
  `CVE-2026-69105` · CVE record: jfrog artifactory · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-345
- [Potential unauthorized metadata exposure in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-70547.md)
  `CVE-2026-70547` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Rendered Artifactory Helm manifests may contain generated TLS private keys](https://agentprime.io/advisories/CVE-2026-66016.md)
  `CVE-2026-66016` · CVE record: jfrog artifactory · CVSS 6.7 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Information disclosure
- [Integration credential holders may impersonate users in JFrog Access](https://agentprime.io/advisories/CVE-2026-68759.md)
  `CVE-2026-68759` · CVE record: jfrog artifactory · CVSS 7.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Weak cryptography or TLS
- [Private Release Bundle versions may be disclosed under specific configurations](https://agentprime.io/advisories/CVE-2026-65926.md)
  `CVE-2026-65926` · CVE record: jfrog artifactory · CVSS 3.1 Low · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Authenticated users may write data outside the intended Docker cache path](https://agentprime.io/advisories/CVE-2026-66384.md)
  `CVE-2026-66384` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Authenticated users may access restricted Artifactory support information](https://agentprime.io/advisories/CVE-2026-68758.md)
  `CVE-2026-68758` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Low-privilege users may remove protected Artifactory metadata](https://agentprime.io/advisories/CVE-2026-66375.md)
  `CVE-2026-66375` · CVE record: jfrog artifactory · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Potential improper SAML signature verification in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68757.md)
  `CVE-2026-68757` · CVE record: jfrog artifactory · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Weak cryptography or TLS
- [Potential insecure deserialization in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68756.md)
  `CVE-2026-68756` · CVE record: jfrog artifactory · CVSS 6.6 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Authenticated users may write files outside the intended Artifactory work directory](https://agentprime.io/advisories/CVE-2026-66382.md)
  `CVE-2026-66382` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Repository readers may access content outside configured upstream paths](https://agentprime.io/advisories/CVE-2026-66381.md)
  `CVE-2026-66381` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal
- [Potential remember-me authentication bypass in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68760.md)
  `CVE-2026-68760` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Authentication bypass
- [Authenticated users may view private Puppet module metadata](https://agentprime.io/advisories/CVE-2026-66379.md)
  `CVE-2026-66379` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Authenticated users may access private NuGet metadata](https://agentprime.io/advisories/CVE-2026-66378.md)
  `CVE-2026-66378` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Anonymous users may access restricted Artifactory repository information](https://agentprime.io/advisories/CVE-2026-66377.md)
  `CVE-2026-66377` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Bundle writers may alter trusted release information in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68755.md)
  `CVE-2026-68755` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Authenticated users may access private OCI referrer metadata](https://agentprime.io/advisories/CVE-2026-66380.md)
  `CVE-2026-66380` · CVE record: jfrog artifactory · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Publishers without delete permission can overwrite docker layer information](https://agentprime.io/advisories/CVE-2026-68754.md)
  `CVE-2026-68754` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Anonymous users may access restricted Artifactory content under specific configurations](https://agentprime.io/advisories/CVE-2026-68753.md)
  `CVE-2026-68753` · CVE record: jfrog artifactory · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Deleted users may temporarily retain access to JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-66376.md)
  `CVE-2026-66376` · CVE record: jfrog artifactory · CVSS 4.2 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Authentication bypass
- [Project Resource Managers may escalate privileges in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68752.md)
  `CVE-2026-68752` · CVE record: jfrog artifactory · CVSS 7.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Potential unauthorized modification of Artifactory internal metadata](https://agentprime.io/advisories/CVE-2026-65922.md)
  `CVE-2026-65922` · CVE record: jfrog artifactory · CVSS 7.1 High · Not analysed yet · Published 27 Jul 2026 · Tags: Broken access control
- [Potential server-side request forgery in Artifactory Ansible repository handling](https://agentprime.io/advisories/CVE-2026-65923.md)
  `CVE-2026-65923` · CVE record: jfrog artifactory · CVSS 6.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Potential remote code execution on an Artifactory package service container.](https://agentprime.io/advisories/CVE-2026-65617.md)
  `CVE-2026-65617` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Insecure deserialization
- [Server-Side Request Forgery (SSRF) via Terraform Remote repository](https://agentprime.io/advisories/CVE-2026-65924.md)
  `CVE-2026-65924` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository](https://agentprime.io/advisories/CVE-2026-65925.md)
  `CVE-2026-65925` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Potential privilege escalation to JFrog administrator privileges](https://agentprime.io/advisories/CVE-2026-65616.md)
  `CVE-2026-65616` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Weak cryptography or TLS
- [JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.](https://agentprime.io/advisories/CVE-2026-66015.md)
  `CVE-2026-66015` · CVE record: jfrog artifactory · CVSS 7.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability](https://agentprime.io/advisories/CVE-2026-65618.md)
  `CVE-2026-65618` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [JFrog Artifactory build environment properties exposure](https://agentprime.io/advisories/CVE-2026-66018.md)
  `CVE-2026-66018` · CVE record: jfrog artifactory · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Information disclosure
- [Potential authentication bypass leading to privilege escalation in Artifactory](https://agentprime.io/advisories/CVE-2026-66014.md)
  `CVE-2026-66014` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Authentication bypass
- [Potential path traversal leading to unauthorized file writes](https://agentprime.io/advisories/CVE-2026-65921.md)
  `CVE-2026-65921` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Privilege escalation via JFrog Worker event token exposure](https://agentprime.io/advisories/CVE-2026-42017.md)
  `CVE-2026-42017` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Information disclosure
- [Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation](https://agentprime.io/advisories/CVE-2026-42016.md)
  `CVE-2026-42016` · CVE record: jfrog artifactory · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 27 Jul 2026 · Tags: Broken access control
- [JFrog Artifactory Cache Poisoning](https://agentprime.io/advisories/CVE-2024-6915.md)
  `CVE-2024-6915` · CVE record: JFrog Artifactory · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2024 · Tags: CWE-20
- [JFrog Artifactory Header Injection](https://agentprime.io/advisories/CVE-2024-2248.md)
  `CVE-2024-2248` · CVE record: JFrog Artifactory · CVSS 6.4 Medium · Not analysed yet · Published 15 May 2024 · Tags: CWE-20
- [JFrog Artifactory Improper input validation within token creation flow](https://agentprime.io/advisories/CVE-2024-4142.md)
  `CVE-2024-4142` · CVE record: JFrog Artifactory · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2024 · Tags: CWE-20
- [JFrog Artifactory Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-2247.md)
  `CVE-2024-2247` · CVE record: JFrog Artifactory · CVSS 8.8 High · Not analysed yet · Published 13 Mar 2024 · Tags: Cross-site scripting (XSS)
- [JFrog Artifactory Sensitive Data Leakage in Repository configuration process](https://agentprime.io/advisories/CVE-2023-42509.md)
  `CVE-2023-42509` · CVE record: JFrog Artifactory · CVSS 6.6 Medium · Not analysed yet · Published 7 Mar 2024 · Tags: CWE-755
- [JFrog Artifactory Improper input validation leads to arbitrary file write](https://agentprime.io/advisories/CVE-2023-42661.md)
  `CVE-2023-42661` · CVE record: JFrog Artifactory · CVSS 7.2 High · Not analysed yet · Published 7 Mar 2024 · Tags: CWE-20
- [JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens](https://agentprime.io/advisories/CVE-2023-42662.md)
  `CVE-2023-42662` · CVE record: JFrog Artifactory · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Mar 2024 · Tags: Authentication bypass
- [JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform](https://agentprime.io/advisories/CVE-2023-42508.md)
  `CVE-2023-42508` · CVE record: JFrog Artifactory · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2023 · Tags: CWE-20
- [JFrog Artifactory: JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass…](https://agentprime.io/advisories/CVE-2022-0668.md)
  `CVE-2022-0668` · CVE record: JFrog JFrog Artifactory · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2023 · Tags: CWE-274
- [Cross-site request forgery in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-23163.md)
  `CVE-2021-23163` · CVE record: JFrog JFrog Artifactory · CVSS 3.1 Low · Not analysed yet · Published 6 Jul 2022 · Tags: Cross-site request forgery (CSRF)
- [Exposure of personal information in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-46687.md)
  `CVE-2021-46687` · CVE record: JFrog JFrog Artifactory · CVSS 4.9 Medium · Not analysed yet · Published 6 Jul 2022 · Tags: Information disclosure
- [Cross-site scripting in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-45721.md)
  `CVE-2021-45721` · CVE record: JFrog JFrog Artifactory · CVSS 6.1 Medium · Not analysed yet · Published 6 Jul 2022 · Tags: Cross-site scripting (XSS)
- [Improper access control in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-41834.md)
  `CVE-2021-41834` · CVE record: JFrog Artifactory · CVSS 5.3 Medium · Not analysed yet · Published 23 May 2022 · Tags: Broken access control
- [Improper access control in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-45730.md)
  `CVE-2021-45730` · CVE record: JFrog Artifactory · CVSS 6.0 Medium · Not analysed yet · Published 19 May 2022 · Tags: Broken access control
- [Deserialization of untrusted data in JFrog Artifactory](https://agentprime.io/advisories/CVE-2022-0573.md)
  `CVE-2022-0573` · CVE record: JFrog JFrog Artifactory · CVSS 8.8 High · Not analysed yet · Published 16 May 2022 · Tags: Insecure deserialization
- [Improper access control in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-46270.md)
  `CVE-2021-46270` · CVE record: JFrog JFrog Artifactory · CVSS 2.7 Low · Not analysed yet · Published 2 Mar 2022 · Tags: Broken access control
- [Improper access control in JFrog Artifactory](https://agentprime.io/advisories/CVE-2021-45074.md)
  `CVE-2021-45074` · CVE record: JFrog JFrog Artifactory · CVSS 4.3 Medium · Not analysed yet · Published 2 Mar 2022 · Tags: Broken access control

Older: <https://agentprime.io/advisories/technology/jfrog-artifactory.md?cursor=WyIyMDIyLTAzLTAyVDIxOjIwOjExLjAwMDAwMFoiLCJDVkUtMjAyMS00NTA3NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=jfrog-artifactory>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/jfrog-artifactory/>. Everything for agents: <https://agentprime.io/llms.txt>.