Skip to content
Noroxi

jfrog records

73 published records for vendor jfrog.

Researcher profile

Entered KEV
4 · 5.5%
Weaponized
4 · 5.5%
Pre-auth RCE
2
With a fix record
8.2%
Median publish → KEV
23 days

Records by year

  1. 16
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

73 records
  • CVE-2026-82329
    73This week

    Potential authentication bypass leading to administrative access in Artifactory

    CriticalCVSS 9.8KEVWeaponizedEPSS 14%

    jfrog · artifactoryAug 28, 2026

  • CVE-2026-42016
    68This week

    Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

    HighCVSS 8.8KEVWeaponizedEPSS 9%

    jfrog · artifactoryJul 27, 2026

  • CVE-2026-42018
    63This week

    Anonymous user token generation exposure in JFrog Artifactory

    HighCVSS 7.5KEVWeaponizedEPSS 10%

    jfrog · artifactoryAug 12, 2026

  • CVE-2019-17444
    60This week

    JFrog Artifactory does not enforce default admin password change

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    jfrog · artifactoryOct 12, 2020

  • CVE-2019-9733
    55Plan

    An issue was discovered in JFrog Artifactory 6.7.3.

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    jfrog · artifactoryApr 11, 2019

  • CVE-2026-66384
    51Plan

    Authenticated users may write data outside the intended Docker cache path

    MediumCVSS 5.3KEVWeaponizedEPSS 1%

    jfrog · artifactoryAug 12, 2026

  • CVE-2016-10036
    47Plan

    Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbit

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    jfrog · artifactoryMay 1, 2018

  • CVE-2016-6501
    40Plan

    JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object,

    CriticalCVSS 9.8No exploitEPSS 4%

    jfrog · artifactoryDec 9, 2016

  • CVE-2018-19971
    40Plan

    JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.

    CriticalCVSS 9.8No exploitEPSS 3%

    jfrog · artifactoryApr 16, 2019

  • CVE-2022-0668
    39Monitor

    JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted r

    CriticalCVSS 9.8No exploitEPSS 1%

    jfrog · artifactoryJan 8, 2023

  • CVE-2020-7931
    37Monitor

    In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authoriz

    HighCVSS 8.8Proof of conceptEPSS 5%

    jfrog · artifactoryJan 23, 2020

  • CVE-2024-6915
    37Monitor

    JFrog Artifactory Cache Poisoning

    CriticalCVSS 9.3No exploitEPSS 1%

    jfrog · artifactoryAug 5, 2024

  • CVE-2022-0573
    36Monitor

    JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Es

    HighCVSS 8.8No exploitEPSS 2%

    jfrog · artifactoryMay 16, 2022

  • CVE-2024-4142
    36Monitor

    JFrog Artifactory Improper input validation within token creation flow

    CriticalCVSS 9.0No exploitEPSS 1%

    jfrog · artifactoryMay 1, 2024

  • CVE-2021-3860
    35Monitor

    JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryDec 20, 2021

  • CVE-2023-42661
    35Monitor

    JFrog Artifactory Improper input validation leads to arbitrary file write

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryMar 7, 2024

  • CVE-2018-1000206
    35Monitor

    JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Class

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryJul 13, 2018

  • CVE-2026-65617
    35Monitor

    Potential remote code execution on an Artifactory package service container.

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryJul 27, 2026

  • CVE-2026-66014
    35Monitor

    Potential authentication bypass leading to privilege escalation in Artifactory

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryJul 27, 2026

  • CVE-2026-65921
    35Monitor

    Potential path traversal leading to unauthorized file writes

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryJul 27, 2026

  • CVE-2026-42017
    35Monitor

    Privilege escalation via JFrog Worker event token exposure

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryJul 27, 2026

  • CVE-2026-69106
    35Monitor

    Potential cache poisoning in JFrog Artifactory

    HighCVSS 8.8No exploitEPSS 1%

    jfrog · artifactoryAug 12, 2026

  • CVE-2026-65616
    35Monitor

    Potential privilege escalation to JFrog administrator privileges

    HighCVSS 8.8Proof of conceptEPSS 0%

    jfrog · artifactoryJul 27, 2026

  • CVE-2021-23163
    35Monitor

    JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints.

    HighCVSS 8.8No exploitEPSS 0%

    jfrog · artifactoryJul 6, 2022

  • CVE-2026-66375
    32Monitor

    Low-privilege users may remove protected Artifactory metadata

    HighCVSS 8.1No exploitEPSS 0%

    jfrog · artifactoryAug 12, 2026