Jfrog vulnerabilities

65 published CVEs name Jfrog among the affected products; CISA lists 4 of them as exploited in the wild.

Critical 6High 21Medium 34Low 4Not scored 0

CVEs per yearBy the year they were published

CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactory
jfrog · artifactory
ExploitedHigh7.5
CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
jfrog · artifactory
ExploitedHigh8.1
CVE-2026-82329
Potential authentication bypass leading to administrative access in Artifactory
jfrog · artifactory
ExploitedCritical9.8
CVE-2026-66384
Authenticated users may write data outside the intended Docker cache path
jfrog · artifactory
ExploitedMedium5.3

CVE-2026-92892
Potential command execution on the host running JFrog CLI.
jfrog · jfrog-cli
Critical9.0
CVE-2026-82329
Potential authentication bypass leading to administrative access in Artifactory
jfrog · artifactory
ExploitedCritical9.8
CVE-2026-70550
Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
jfrog · artifactory
Medium6.5
CVE-2026-70548
SSRF In CocoaPods Via JFrog Artifactory External Dependency
jfrog · artifactory
Low3.5
CVE-2026-69104
Potential unauthorized repository migration in JFrog Artifactory
jfrog · artifactory
High7.6
CVE-2026-70551
Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
jfrog · artifactory
High8.5
CVE-2026-69106
Potential cache poisoning in JFrog Artifactory
jfrog · artifactory
High8.8
CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactory
jfrog · artifactory
ExploitedHigh7.5
CVE-2026-69107
Potential unauthorized artifact access in JFrog Artifactory
jfrog · artifactory
Medium5.9
CVE-2026-69105
Potential package cache integrity issue in JFrog Artifactory
jfrog · artifactory
High8.1