https://www.cloudrepo.io/vulnerabilities/artifactory Up to 50 of the newest CVEs on record for JFrog Artifactory self-managed 7.x, from NVD and JFrog's advisories, as the CloudRepo vulnerability lookup lists them. Each item gives the severity, the versions the record says are affected and a link to our page for the lowest of them. An item's date is the day NVD published the CVE, not the day we added it. Dataset pulled 2026-10-23. en-us https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-82329 Fri, 28 Aug 2026 00:00:00 GMT JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Severity: Critical (CVSS 3.1 9.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): from 7.111.4 (including), before 7.111.21; from 7.117.0 (including), before 7.117.28; from 7.125.0 (including), before 7.125.20; from 7.133.0 (including), before 7.133.29; from 7.146.0 (including), before 7.146.38; from 7.161.0 (including), before 7.161.20. JFrog's CVE record: from 0 before 7.111.21; from 7.117.0 before 7.117.28; from 7.125.0 before 7.125.20; from 7.133.0 before 7.133.29; from 7.146.0 before 7.146.38; from 7.161.0 before 7.161.20. The lowest version we list that this affects is 7.0.0. Published by NVD on August 28, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-146-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-70551 Tue, 25 Aug 2026 00:00:00 GMT A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. Severity: High (CVSS 3.1 8.5, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Awaiting Analysis). JFrog's CVE record: from 7.146.0 before 7.146.36; from 7.161.0 before 7.161.19. The lowest version we list that this affects is 7.146.7. Published by NVD on August 25, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-146-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-70550 Tue, 25 Aug 2026 00:00:00 GMT An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Awaiting Analysis). JFrog: versions.. The lowest version we list that this affects is 7.146.7. Published by NVD on August 25, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-146-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-70548 Tue, 25 Aug 2026 00:00:00 GMT Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. Severity: Low (CVSS 3.1 3.5, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Awaiting Analysis). JFrog's CVE record: from 7.146.0 before 7.146.36; from 7.161.11 before 7.161.19. The lowest version we list that this affects is 7.146.7. Published by NVD on August 25, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-161-15 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-69104 Tue, 25 Aug 2026 00:00:00 GMT An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Severity: High (CVSS 3.1 7.6, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Awaiting Analysis). JFrog: versions address the issue.. The lowest version we list that this affects is 7.161.15. Published by NVD on August 25, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-161-15 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-70547 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user without repository read permission may access package metadata under specific conditions. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.161.15. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-69107 Wed, 12 Aug 2026 00:00:00 GMT An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. Severity: Medium (CVSS 3.1 5.9, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.104.16; from 7.111.0 (including), before 7.111.14; from 7.117.0 (including), before 7.117.21; from 7.125.0 (including), before 7.125.14; from 7.133.0 (including), before 7.133.21; from 7.146.0 (including), before 7.146.8. JFrog's CVE record: from 0 before 7.104.16; from 7.111.0 before 7.111.14; from 7.117.0 before 7.117.21; from 7.125.0 before 7.125.14; from 7.133.0 before 7.133.21; from 7.146.0 before 7.146.8. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-69106 Wed, 12 Aug 2026 00:00:00 GMT A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. Severity: High (CVSS 3.1 8.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.28. JFrog's CVE record: from 0 before 7.146.28. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-161-15 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-69105 Wed, 12 Aug 2026 00:00:00 GMT An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability. Severity: High (CVSS 3.1 8.1, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.161.15. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68760 Wed, 12 Aug 2026 00:00:00 GMT An unauthenticated user may bypass authentication under specific cache conditions. Severity: Medium (CVSS 3.1 5.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68759 Wed, 12 Aug 2026 00:00:00 GMT A holder of a valid integration credential may impersonate other users under specific conditions. Severity: High (CVSS 3.1 7.2, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68758 Wed, 12 Aug 2026 00:00:00 GMT A low-privileged authenticated user may access restricted support information under specific conditions. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68757 Wed, 12 Aug 2026 00:00:00 GMT A user with access to a valid SAML response may impersonate another user under specific conditions. Severity: High (CVSS 3.1 7.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68756 Wed, 12 Aug 2026 00:00:00 GMT A party with write access to stored session data may affect JFrog Artifactory under specific conditions. Severity: Medium (CVSS 3.1 6.6, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68755 Wed, 12 Aug 2026 00:00:00 GMT A bundle writer may create misleading release promotion information under specific conditions. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68754 Wed, 12 Aug 2026 00:00:00 GMT A repository publisher without delete permission may modify protected package content under specific conditions. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68753 Wed, 12 Aug 2026 00:00:00 GMT An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. Severity: Medium (CVSS 3.1 5.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-68752 Wed, 12 Aug 2026 00:00:00 GMT A Project Resource Manager may gain broader administrative privileges under specific conditions. Severity: High (CVSS 3.1 7.2, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35. JFrog's CVE record: from 0 before 7.146.35. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66384 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. Severity: Medium (CVSS 3.1 5.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66382 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user may write files outside the intended Artifactory work directory under specific conditions. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66381 Wed, 12 Aug 2026 00:00:00 GMT A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. Severity: Medium (CVSS 3.1 5.3, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66380 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66379 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user may view private Puppet module metadata without repository read access. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66378 Wed, 12 Aug 2026 00:00:00 GMT An authenticated user without repository read permission may access private NuGet metadata under specific conditions. Severity: Medium (CVSS 3.1 4.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66377 Wed, 12 Aug 2026 00:00:00 GMT An unauthenticated user may access restricted repository information under specific conditions. Severity: Medium (CVSS 3.1 5.3, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66376 Wed, 12 Aug 2026 00:00:00 GMT Credentials for a deleted user may remain valid for a short period under specific conditions. Severity: Medium (CVSS 3.1 5.4, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66375 Wed, 12 Aug 2026 00:00:00 GMT A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. Severity: High (CVSS 3.1 8.1, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66016 Wed, 12 Aug 2026 00:00:00 GMT Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. Severity: Medium (CVSS 3.1 6.7, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.35; from 7.161.0 (including), before 7.161.16. JFrog's CVE record: from 0 before 7.146.35; from 7.161.0 before 7.161.16. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65926 Wed, 12 Aug 2026 00:00:00 GMT An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known. Severity: Low (CVSS 3.1 3.1, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Awaiting Analysis). JFrog: versions when the bundle name. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-42018 Wed, 12 Aug 2026 00:00:00 GMT JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. Severity: High (CVSS 3.1 7.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.20; from 7.117.0 (including), before 7.117.27; from 7.125.0 (including), before 7.125.19; from 7.133.0 (including), before 7.133.28; from 7.146.0 (including), before 7.146.8. JFrog's CVE record: from 0 before 7.111.20; from 7.117.0 before 7.117.27; from 7.125.0 before 7.125.19; from 7.133.0 before 7.133.28; from 7.146.0 before 7.146.8. The lowest version we list that this affects is 7.0.0. Published by NVD on August 12, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-146-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66018 Mon, 27 Jul 2026 00:00:00 GMT Build readers can access another repository's environment properties. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.146.7. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-146-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66015 Mon, 27 Jul 2026 00:00:00 GMT An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Severity: High (CVSS 3.1 7.2, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.146.7. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-66014 Mon, 27 Jul 2026 00:00:00 GMT JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level. Severity: High (CVSS 3.1 8.8, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65925 Mon, 27 Jul 2026 00:00:00 GMT A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65924 Mon, 27 Jul 2026 00:00:00 GMT JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65923 Mon, 27 Jul 2026 00:00:00 GMT A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. Severity: Medium (CVSS 3.1 6.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog: versions.. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65922 Mon, 27 Jul 2026 00:00:00 GMT An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Severity: Medium (CVSS 3.1 5.4, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65921 Mon, 27 Jul 2026 00:00:00 GMT A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location. Severity: High (CVSS 3.1 8.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65618 Mon, 27 Jul 2026 00:00:00 GMT Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data. Severity: Medium (CVSS 3.1 6.5, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.133.6. JFrog's CVE record: from 0 before 7.133.6. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65617 Mon, 27 Jul 2026 00:00:00 GMT A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions. Severity: High (CVSS 3.1 8.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.111.18; from 7.117.0 (including), before 7.117.25; from 7.125.0 (including), before 7.125.18; from 7.133.0 (including), before 7.133.27; from 7.146.0 (including), before 7.146.34; from 7.161.0 (including), before 7.161.15. JFrog's CVE record: from 0 before 7.111.18; from 7.117.0 before 7.117.25; from 7.125.0 before 7.125.18; from 7.133.0 before 7.133.27; from 7.146.0 before 7.146.34; from 7.161.0 before 7.161.15. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-65616 Mon, 27 Jul 2026 00:00:00 GMT Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. Severity: High (CVSS 3.1 8.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.146.27. JFrog's CVE record: from 0 before 7.146.27. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-42017 Mon, 27 Jul 2026 00:00:00 GMT An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. Severity: High (CVSS 3.1 8.8, rated by JFrog (CNA)). Affected versions: NVD configuration (NVD status: Analyzed): before 7.133.21; from 7.146.0 (including), before 7.146.8. JFrog's CVE record: from 0 before 7.133.21; from 7.146.0 before 7.146.8. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2026-42016 Mon, 27 Jul 2026 00:00:00 GMT JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Severity: High (CVSS 3.1 8.8, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.133.11. JFrog: versions before 7.133.11. The lowest version we list that this affects is 7.0.0. Published by NVD on July 27, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-98-7 cloudrepo.io/vulnerabilities/artifactory#CVE-2025-14830 Sun, 04 Jan 2026 00:00:00 GMT Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10. Severity: Medium (CVSS 3.1 4.9, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Deferred). JFrog's CVE record: from 7.94.0 before 7.117.10. The lowest version we list that this affects is 7.98.7. Published by NVD on January 4, 2026. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2024-6915 Mon, 05 Aug 2024 00:00:00 GMT JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning. Severity: Critical (CVSS 3.1 9.3, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Deferred). JFrog: versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18. The lowest version we list that this affects is 7.0.0. Published by NVD on August 5, 2024. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2024-2248 Wed, 15 May 2024 00:00:00 GMT A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email. Severity: Medium (CVSS 3.1 6.4, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Deferred). JFrog: versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted). The lowest version we list that this affects is 7.0.0. Published by NVD on May 15, 2024. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2024-4142 Wed, 01 May 2024 00:00:00 GMT An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Severity: Critical (CVSS 3.1 9.0, rated by JFrog (CNA)). Affected versions: NVD has published no version configuration for this record (NVD status: Deferred). JFrog's CVE record: from 0 before 7.55.17; from 0 before 7.59.22; from 0 before 7.63.21; from 0 before 7.68.21; from 0 before 7.71.21; from 0 before 7.77.11; from 0 before 7.84.6. The lowest version we list that this affects is 7.0.0. Published by NVD on May 1, 2024. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2024-3505 Mon, 15 Apr 2024 00:00:00 GMT JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. Severity: Medium (CVSS 3.1 4.3, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): before 7.77.3. JFrog: versions below 7.77.3. The lowest version we list that this affects is 7.0.0. Published by NVD on April 15, 2024. https://www.cloudrepo.io/vulnerabilities/artifactory/7-0-0 cloudrepo.io/vulnerabilities/artifactory#CVE-2024-2247 Wed, 13 Mar 2024 00:00:00 GMT JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. Severity: Medium (CVSS 3.1 6.1, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): through 7.77.7. JFrog: versions below 7.77.7, 7.82.1. The lowest version we list that this affects is 7.0.0. Published by NVD on March 13, 2024. https://www.cloudrepo.io/vulnerabilities/artifactory/7-59-9 cloudrepo.io/vulnerabilities/artifactory#CVE-2023-42662 Thu, 07 Mar 2024 00:00:00 GMT JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration. Severity: Medium (CVSS 3.1 6.5, rated by NVD). Affected versions: NVD configuration (NVD status: Analyzed): from 7.59.0 (including), before 7.59.18; from 7.63.5 (including), before 7.63.18; from 7.68.7 (including), before 7.68.19; from 7.71.2 (including), before 7.71.8. JFrog: versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8. The lowest version we list that this affects is 7.59.9. Published by NVD on March 7, 2024.