Vendor
jfrog
65 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Critical 9.0
Potential command execution on the host running JFrog CLI.
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
-
Critical 9.8
Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
KEV Sep 2, 2026 -
Critical 9.3
JFrog Artifactory Cache Poisoning
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.
-
Critical 9.0
JFrog Artifactory Improper input validation within token creation flow
An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be explo…
-
Critical 9.3
JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE brows…
-
Critical 9.8
JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Ar…