Vulnerabilidades de Jfrog
CVEs publicadas que afetam produtos de Jfrog: 40 registro(s), com severidade, exploração e correções.
CVE-2026-92892
Crítica · 9.0
CWE-88 13/10/2026
Potential command execution on the host running JFrog CLI.
Potential arbitrary code execution, under specific configurations.
CVE-2026-82329
Crítica · 9.8
KEV Urgente · 72 Exploit público CWE-287 28/08/2026
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
CVE-2026-69106
Alta · 8.8
CWE-20 12/08/2026
Improper Input Validation em Jfrog Artifactory
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
CVE-2026-42018
Alta · 7.5
KEV Alta · 62 Exploit público CWE-287 12/08/2026
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-70547
Média · 4.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An authenticated user without repository read permission may access package metadata under specific conditions.
CVE-2026-69107
Média · 5.9
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
CVE-2026-69105
Alta · 8.1
CWE-345 12/08/2026
Insufficient Verification of Data Authenticity em Jfrog Artifactory
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
CVE-2026-68759
Alta · 7.2
CWE-347 12/08/2026
Improper Verification of Cryptographic Signature em Jfrog Artifactory
A holder of a valid integration credential may impersonate other users under specific conditions.
CVE-2026-68758
Média · 6.5
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
A low-privileged authenticated user may access restricted support information under specific conditions.
CVE-2026-66016
Média · 6.7
CWE-312 12/08/2026
Cleartext Storage of Sensitive Information em Jfrog Artifactory
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
CVE-2026-66384
Média · 5.3
KEV Alta · 52 Exploit público CWE-22 12/08/2026
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-68760
Média · 5.3
CWE-287 12/08/2026
Improper Authentication em Jfrog Artifactory
An unauthenticated user may bypass authentication under specific cache conditions.
CVE-2026-68757
Alta · 7.5
CWE-347 12/08/2026
Improper Verification of Cryptographic Signature em Jfrog Artifactory
A user with access to a valid SAML response may impersonate another user under specific conditions.
CVE-2026-68756
Média · 6.6
CWE-502 12/08/2026
Deserialization of Untrusted Data em Jfrog Artifactory
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
CVE-2026-68755
Média · 4.3
CWE-863 12/08/2026
Incorrect Authorization em Jfrog Artifactory
A bundle writer may create misleading release promotion information under specific conditions.
CVE-2026-68754
Média · 6.5
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
A repository publisher without delete permission may modify protected package content under specific conditions.
CVE-2026-68753
Média · 5.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
CVE-2026-68752
Alta · 7.2
CWE-269 12/08/2026
Improper Privilege Management em Jfrog Artifactory
A Project Resource Manager may gain broader administrative privileges under specific conditions.
CVE-2026-66382
Média · 4.3
CWE-22 12/08/2026
Path Traversal em Jfrog Artifactory
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
CVE-2026-66381
Média · 5.3
CWE-22 12/08/2026
Path Traversal em Jfrog Artifactory
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVE-2026-66380
Média · 4.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
CVE-2026-66379
Média · 4.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An authenticated user may view private Puppet module metadata without repository read access.
CVE-2026-66378
Média · 4.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
CVE-2026-66377
Média · 5.3
CWE-862 12/08/2026
Missing Authorization em Jfrog Artifactory
An unauthenticated user may access restricted repository information under specific conditions.
CVE-2026-66376
Média · 5.4
CWE-613 12/08/2026
Credentials for a deleted user may remain valid for a short period under specific…
Credentials for a deleted user may remain valid for a short period under specific conditions.