Jfrog Artifactory vulnerabilities, page 3
78 vulnerabilities
Known vulnerabilities in Jfrog Artifactory, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-68760jfrogartifactory
EPSS score0.46%
An unauthenticated user may bypass authentication under specific cache conditions.CVE-2026-68759jfrogartifactoryEPSS score0.33%
A holder of a valid integration credential may impersonate other users under specific conditions.CVE-2026-68753jfrogartifactoryEPSS score0.31%
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.CVE-2026-68758jfrogartifactoryEPSS score0.35%
A low-privileged authenticated user may access restricted support information under specific conditions.CVE-2026-68756jfrogartifactoryEPSS score0.47%
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.CVE-2026-68754jfrogartifactoryEPSS score0.31%
A repository publisher without delete permission may modify protected package content under specific conditions.CVE-2026-68755jfrogartifactoryEPSS score0.26%
A bundle writer may create misleading release promotion information under specific conditions.CVE-2026-68757jfrogartifactoryEPSS score0.27%
A user with access to a valid SAML response may impersonate another user under specific conditions.CVE-2026-68752jfrogartifactoryEPSS score0.49%
A Project Resource Manager may gain broader administrative privileges under specific conditions.CVE-2026-42017jfrogartifactoryEPSS score0.52%
An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.CVE-2026-42018jfrogartifactoryKEVEPSS score9.80%
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.CVE-2026-42016jfrogartifactoryKEVEPSS score8.64%
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.CVE-2026-66382jfrogartifactoryEPSS score0.35%
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.CVE-2026-66376jfrogartifactoryEPSS score0.22%
Credentials for a deleted user may remain valid for a short period under specific conditions.CVE-2026-66380jfrogartifactoryEPSS score0.30%
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.CVE-2026-66379ubuntupuppet+1EPSS score0.30%
An authenticated user may view private Puppet module metadata without repository read access.CVE-2026-66014jfrogartifactoryEPSS score0.64%
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.CVE-2026-66015jfrogartifactoryEPSS score0.57%
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.CVE-2026-66381jfrogartifactoryEPSS score0.39%
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.CVE-2026-66377jfrogartifactoryEPSS score0.36%
An unauthenticated user may access restricted repository information under specific conditions.