Artifactory 7.133.30 22 known CVEs

End of life is July 22, 2027 per JFrog's end-of-life table.

JFrog Artifactory 7.133.30
From JFrog's release pages and end-of-life table, and NVD
  1. Released September 5, 2026
  2. End of life July 22, 2027
  3. Latest release 7.161.32, October 6, 2026
  4. Behind latest 31 days
  5. Lowest upgrade that clears all 22 7.146.35
  6. High 6 Medium 15 Low 1
Known CVEs 22
The same 22 as 2 other releases, listed under the table

A lookup, not a scan of your server. 21 of the 22 come from NVD's exact CPE match, and 1 more from JFrog's advisories that NVD has not analyzed. Pulled October 23, 2026. Sources and method

Tired of patching Artifactory yourself?

This is what we do. We host your Maven, npm, PyPI and Docker repositories, so there's no Artifactory server to upgrade or patch.

Our migration tool, free to use with CloudRepo, moves your Maven repositories off Artifactory and checks every file.

Start free trial

14 days free. No credit card required.

Or book a call with Chris

Upgrade path

7.146.35 is the lowest release above 7.133.30 that clears all 22 of these. Later releases may carry CVEs published after it, so check the version you land on.

No known security breaches in our history.

The 22 CVEs that affect 7.133.30

Sorted by severity. A CVE counts when either NVD or JFrog says this version is affected; both verdicts are shown. Latest release: 7.161.32.

CVEs that affect JFrog Artifactory 7.133.30
CVE Severity NVD JFrog Fix
CVE-2026-65616 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by JFrog (CNA) yes yes 7.146.27 nearest fix; none on your branch
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

NVD configuration (NVD status: Analyzed): before 7.146.27.

JFrog's CVE record: from 0 before 7.146.27.

NVD record JFrog advisory

CVE-2026-69106 August 12, 2026 High 8.8 CVSS 3.1 8.8, rated by JFrog (CNA) yes yes 7.146.28 nearest fix; none on your branch
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

NVD configuration (NVD status: Analyzed): before 7.146.28.

JFrog's CVE record: from 0 before 7.146.28.

NVD record JFrog advisory

CVE-2026-66375 August 12, 2026 High 8.1 CVSS 3.1 8.1, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68757 August 12, 2026 High 7.5 CVSS 3.1 7.5, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A user with access to a valid SAML response may impersonate another user under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68752 August 12, 2026 High 7.2 CVSS 3.1 7.2, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A Project Resource Manager may gain broader administrative privileges under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35.

JFrog's CVE record: from 0 before 7.146.35.

NVD record JFrog advisory

CVE-2026-68759 August 12, 2026 High 7.2 CVSS 3.1 7.2, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A holder of a valid integration credential may impersonate other users under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66016 August 12, 2026 Medium 6.7 CVSS 3.1 6.7, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68756 August 12, 2026 Medium 6.6 CVSS 3.1 6.6, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68754 August 12, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A repository publisher without delete permission may modify protected package content under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68758 August 12, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A low-privileged authenticated user may access restricted support information under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66376 August 12, 2026 Medium 5.4 CVSS 3.1 5.4, rated by NVD yes yes 7.146.35 nearest fix; none on your branch
Credentials for a deleted user may remain valid for a short period under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66377 August 12, 2026 Medium 5.3 CVSS 3.1 5.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An unauthenticated user may access restricted repository information under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66381 August 12, 2026 Medium 5.3 CVSS 3.1 5.3, rated by NVD yes yes 7.146.35 nearest fix; none on your branch
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66384 August 12, 2026 Medium 5.3 CVSS 3.1 5.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68753 August 12, 2026 Medium 5.3 CVSS 3.1 5.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68760 August 12, 2026 Medium 5.3 CVSS 3.1 5.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An unauthenticated user may bypass authentication under specific cache conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66378 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66379 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An authenticated user may view private Puppet module metadata without repository read access.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66380 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-66382 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-68755 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) yes yes 7.146.35 nearest fix; none on your branch
A bundle writer may create misleading release promotion information under specific conditions.

NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-65926 August 12, 2026 Low 3.1 CVSS 3.1 3.1, rated by JFrog (CNA) no NVD data yes 7.146.35 nearest fix; none on your branch
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

JFrog: versions when the bundle name.

NVD record JFrog advisory

41 other JFrog Artifactory CVEs on record that do not affect 7.133.30

Each of these is fixed at or before 7.133.30 on its branch, or its published range does not include this version.

JFrog Artifactory CVEs on record that do not affect 7.133.30
CVE Severity NVD JFrog Fix
CVE-2022-0668 January 8, 2023 Critical 9.8 CVSS 3.1 9.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2022-0668

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.41; from 7.0.0 (including), before 7.37.13.

JFrog: prior to 7.37.13.

NVD record JFrog advisory

CVE-2026-82329 August 28, 2026 Critical 9.8 CVSS 3.1 9.8, rated by JFrog (CNA) no no 7.133.29 already fixed in this version
Ranges and sources for CVE-2026-82329

NVD configuration (NVD status: Analyzed): from 7.111.4 (including), before 7.111.21; from 7.117.0 (including), before 7.117.28; from 7.125.0 (including), before 7.125.20; from 7.133.0 (including), before 7.133.29; from 7.146.0 (including), before 7.146.38; from 7.161.0 (including), before 7.161.20.

JFrog's CVE record: from 0 before 7.111.21; from 7.117.0 before 7.117.28; from 7.125.0 before 7.125.20; from 7.133.0 before 7.133.29; from 7.146.0 before 7.146.38; from 7.161.0 before 7.161.20.

NVD record JFrog advisory

CVE-2024-6915 August 5, 2024 Critical 9.3 CVSS 3.1 9.3, rated by JFrog (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2024-6915

NVD has published no version configuration for this record (NVD status: Deferred).

JFrog: versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18.

NVD record JFrog advisory

CVE-2024-4142 May 1, 2024 Critical 9.0 CVSS 3.1 9.0, rated by JFrog (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2024-4142

NVD has published no version configuration for this record (NVD status: Deferred).

JFrog's CVE record: from 0 before 7.55.17; from 0 before 7.59.22; from 0 before 7.63.21; from 0 before 7.68.21; from 0 before 7.71.21; from 0 before 7.77.11; from 0 before 7.84.6.

NVD record JFrog advisory

CVE-2021-23163 July 6, 2022 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-23163

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.38; from 7.0.0 (including), before 7.33.6.

JFrog: prior to version 7.33.6 and 6.23.38.

NVD record JFrog advisory

CVE-2021-3860 December 20, 2021 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-3860

NVD configuration (NVD status: Modified): before 6.23.30; from 7.11.0 (including), before 7.11.8; from 7.12.0 (including), before 7.12.10; from 7.17.0 (including), before 7.17.14; from 7.18.0 (including), before 7.18.11; from 7.19.0 (including), before 7.19.12; from 7.21.0 (including), before 7.21.14; from 7.23.0 (including), before 7.23.8; from 7.24.0 (including), before 7.24.7; from 7.25.0 (including), before 7.25.4.

JFrog: before 7.25.4 (Enterprise+ deployments only).

NVD record JFrog advisory

CVE-2022-0573 May 16, 2022 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2022-0573

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.41; from 7.0.0 (including), before 7.17.16; from 7.18.0 (including), before 7.18.12; from 7.19.0 (including), before 7.19.13; from 7.21.0 (including), before 7.21.25; from 7.25.0 (including), before 7.25.9; from 7.27.0 (including), before 7.27.15; from 7.29.0 (including), before 7.29.10; from 7.31.0 (including), before 7.31.16; from 7.33.0 (including), before 7.33.12; from 7.34.0 (including), before 7.34.4; exactly 7.35.0; exactly 7.36.0.

JFrog: before 7.36.1 and 6.23.41.

NVD record JFrog advisory

CVE-2023-42661 March 7, 2024 High 8.8 CVSS 3.1 8.8, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2023-42661

NVD configuration (NVD status: Analyzed): before 7.76.2.

JFrog: prior to version 7.76.2.

NVD record JFrog advisory

CVE-2026-42016 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no 7.133.11 already fixed in this version
Ranges and sources for CVE-2026-42016

NVD configuration (NVD status: Analyzed): before 7.133.11.

JFrog: versions before 7.133.11.

NVD record JFrog advisory

CVE-2026-42017 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by JFrog (CNA) no no 7.133.21 already fixed in this version
Ranges and sources for CVE-2026-42017

NVD configuration (NVD status: Analyzed): before 7.133.21; from 7.146.0 (including), before 7.146.8.

JFrog's CVE record: from 0 before 7.133.21; from 7.146.0 before 7.146.8.

NVD record JFrog advisory

CVE-2026-65617 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by JFrog (CNA) no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65617

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-65921 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by JFrog (CNA) no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65921

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-66014 July 27, 2026 High 8.8 CVSS 3.1 8.8, rated by NVD no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-66014

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-70551 August 25, 2026 High 8.5 CVSS 3.1 8.5, rated by JFrog (CNA) no NVD data no Predates the affected range (from 7.146.0).
Ranges and sources for CVE-2026-70551

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

JFrog's CVE record: from 7.146.0 before 7.146.36; from 7.161.0 before 7.161.19.

NVD record JFrog advisory

CVE-2026-69105 August 12, 2026 High 8.1 CVSS 3.1 8.1, rated by JFrog (CNA) no no Predates the affected range (from 7.161.0).
Ranges and sources for CVE-2026-69105

NVD configuration (NVD status: Analyzed): from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-69104 August 25, 2026 High 7.6 CVSS 3.1 7.6, rated by JFrog (CNA) no NVD data no Predates the affected range (from 7.161.0).
Ranges and sources for CVE-2026-69104

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

JFrog: versions address the issue..

NVD record JFrog advisory

CVE-2023-42509 March 7, 2024 High 7.5 CVSS 3.1 7.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2023-42509

NVD configuration (NVD status: Analyzed): from 7.17.4 (including), before 7.77.0.

JFrog: version 7.17.4 but prior to version 7.77.0.

NVD record JFrog advisory

CVE-2026-42018 August 12, 2026 High 7.5 CVSS 3.1 7.5, rated by JFrog (CNA) no no 7.133.28 already fixed in this version
Ranges and sources for CVE-2026-42018

NVD configuration (NVD status: Analyzed): before 7.111.20; from 7.117.0 (including), before 7.117.27; from 7.125.0 (including), before 7.125.19; from 7.133.0 (including), before 7.133.28; from 7.146.0 (including), before 7.146.8.

JFrog's CVE record: from 0 before 7.111.20; from 7.117.0 before 7.117.27; from 7.125.0 before 7.125.19; from 7.133.0 before 7.133.28; from 7.146.0 before 7.146.8.

NVD record JFrog advisory

CVE-2026-66015 July 27, 2026 High 7.2 CVSS 3.1 7.2, rated by JFrog (CNA) no no Predates the affected range (from 7.146.0).
Ranges and sources for CVE-2026-66015

NVD configuration (NVD status: Analyzed): from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-65923 July 27, 2026 Medium 6.8 CVSS 3.1 6.8, rated by JFrog (CNA) no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65923

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog: versions..

NVD record JFrog advisory

CVE-2021-41834 May 23, 2022 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-41834

NVD configuration (NVD status: Modified): before 6.23.38; from 7.0.0 (including), before 7.28.0.

JFrog: prior to version 7.28.0 and 6.23.38.

NVD record JFrog advisory

CVE-2023-42508 October 3, 2023 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2023-42508

NVD configuration (NVD status: Modified): from 7.0.0 (including), before 7.66.0.

JFrog: prior to version 7.66.0.

NVD record JFrog advisory

CVE-2023-42662 March 7, 2024 Medium 6.5 CVSS 3.1 6.5, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2023-42662

NVD configuration (NVD status: Analyzed): from 7.59.0 (including), before 7.59.18; from 7.63.5 (including), before 7.63.18; from 7.68.7 (including), before 7.68.19; from 7.71.2 (including), before 7.71.8.

JFrog: versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8.

NVD record JFrog advisory

CVE-2026-65618 July 27, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) no no 7.133.6 already fixed in this version
Ranges and sources for CVE-2026-65618

NVD configuration (NVD status: Analyzed): before 7.133.6.

JFrog's CVE record: from 0 before 7.133.6.

NVD record JFrog advisory

CVE-2026-65924 July 27, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65924

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-65925 July 27, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65925

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-66018 July 27, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) no no Predates the affected range (from 7.146.0).
Ranges and sources for CVE-2026-66018

NVD configuration (NVD status: Analyzed): from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2026-70550 August 25, 2026 Medium 6.5 CVSS 3.1 6.5, rated by JFrog (CNA) no NVD data no Predates the affected range (from 7.146.0).
Ranges and sources for CVE-2026-70550

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

JFrog: versions..

NVD record JFrog advisory

CVE-2024-2248 May 15, 2024 Medium 6.4 CVSS 3.1 6.4, rated by JFrog (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2024-2248

NVD has published no version configuration for this record (NVD status: Deferred).

JFrog: versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted).

NVD record JFrog advisory

CVE-2021-45721 July 6, 2022 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-45721

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.38; from 7.0.0 (including), before 7.29.8.

JFrog: prior to version 7.29.8 and 6.23.38.

NVD record JFrog advisory

CVE-2024-2247 March 13, 2024 Medium 6.1 CVSS 3.1 6.1, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2024-2247

NVD configuration (NVD status: Analyzed): through 7.77.7.

JFrog: versions below 7.77.7, 7.82.1.

NVD record JFrog advisory

CVE-2026-69107 August 12, 2026 Medium 5.9 CVSS 3.1 5.9, rated by JFrog (CNA) no no 7.133.21 already fixed in this version
Ranges and sources for CVE-2026-69107

NVD configuration (NVD status: Analyzed): before 7.104.16; from 7.111.0 (including), before 7.111.14; from 7.117.0 (including), before 7.117.21; from 7.125.0 (including), before 7.125.14; from 7.133.0 (including), before 7.133.21; from 7.146.0 (including), before 7.146.8.

JFrog's CVE record: from 0 before 7.104.16; from 7.111.0 before 7.111.14; from 7.117.0 before 7.117.21; from 7.125.0 before 7.125.14; from 7.133.0 before 7.133.21; from 7.146.0 before 7.146.8.

NVD record JFrog advisory

CVE-2021-45074 March 2, 2022 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-45074

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.38; from 7.0.0 (including), before 7.29.3.

JFrog: before 7.29.3 and 6.23.38.

NVD record JFrog advisory

CVE-2026-65922 July 27, 2026 Medium 5.4 CVSS 3.1 5.4, rated by NVD no no 7.133.27 already fixed in this version
Ranges and sources for CVE-2026-65922

NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15.

JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15.

NVD record JFrog advisory

CVE-2021-45730 May 19, 2022 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-45730

NVD configuration (NVD status: Modified): from 7.0.0 (including), before 7.31.10.

JFrog: prior to 7.31.10.

NVD record JFrog advisory

CVE-2021-46687 July 6, 2022 Medium 4.9 CVSS 3.1 4.9, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-46687

NVD configuration (NVD status: Modified): from 6.0.0 (including), before 6.23.38; from 7.0.0 (including), before 7.31.10.

JFrog: prior to version 7.31.10 and 6.23.38.

NVD record JFrog advisory

CVE-2025-14830 January 4, 2026 Medium 4.9 CVSS 3.1 4.9, rated by JFrog (CNA) no NVD data no Outside the affected range.
Ranges and sources for CVE-2025-14830

NVD has published no version configuration for this record (NVD status: Deferred).

JFrog's CVE record: from 7.94.0 before 7.117.10.

NVD record JFrog advisory

CVE-2024-3505 April 15, 2024 Medium 4.3 CVSS 3.1 4.3, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2024-3505

NVD configuration (NVD status: Analyzed): before 7.77.3.

JFrog: versions below 7.77.3.

NVD record JFrog advisory

CVE-2026-70547 August 12, 2026 Medium 4.3 CVSS 3.1 4.3, rated by JFrog (CNA) no no Predates the affected range (from 7.161.0).
Ranges and sources for CVE-2026-70547

NVD configuration (NVD status: Analyzed): from 7.161.0 (including), before 7.161.16.

JFrog's CVE record: from 7.161.0 before 7.161.16.

NVD record JFrog advisory

CVE-2026-70548 August 25, 2026 Low 3.5 CVSS 3.1 3.5, rated by JFrog (CNA) no NVD data no Predates the affected range (from 7.146.0).
Ranges and sources for CVE-2026-70548

NVD has published no version configuration for this record (NVD status: Awaiting Analysis).

JFrog's CVE record: from 7.146.0 before 7.146.36; from 7.161.11 before 7.161.19.

NVD record JFrog advisory

CVE-2021-46270 March 2, 2022 Low 2.7 CVSS 3.1 2.7, rated by NVD no no Outside the affected range.
Ranges and sources for CVE-2021-46270

NVD configuration (NVD status: Modified): from 7.0.0 (including), before 7.31.10.

JFrog: before 7.31.10.

NVD record JFrog advisory

Sources and method

NVD's count evaluates NVD's published version ranges against this version; those ranges do not carry JFrog's per-branch fixes, so the NVD column can read the same on either side of a fix that JFrog names. Where NVD has not analyzed a record, the row reads "no NVD data", not "no".

7.133.30 carries the same 22 known CVEs as 2 other JFrog Artifactory releases: 7.133.29, 7.133.31.

JFrog's policy: JFrog supports self-managed versions of Artifactory for 18 months from the release of the initial minor version.

Sources: NVD (exact CPE match and the published configurations), the CVE Program record (the vendor's CNA entry with its affected and fixed versions), JFrog's security advisories, release notes and end-of-life page. Pulled October 23, 2026. Every CVE row links to its NVD record and to the vendor's advisory.

Next