Artifactory
by Jfrog
Source repositories
CVEs (73)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66375 | Hig | 0.53 | 8.1 | 0.00 | Aug 12, 2026 | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. | ||
| CVE-2026-69104 | Hig | 0.49 | 7.6 | 0.00 | Aug 25, 2026 | An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue. | ||
| CVE-2026-68757 | Hig | 0.49 | 7.5 | 0.00 | Aug 12, 2026 | A user with access to a valid SAML response may impersonate another user under specific conditions. | ||
| CVE-2020-2165 | Hig | 0.49 | 7.5 | 0.01 | Mar 25, 2020 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. | ||
| CVE-2026-68759 | Hig | 0.47 | 7.2 | 0.00 | Aug 12, 2026 | A holder of a valid integration credential may impersonate other users under specific conditions. | ||
| CVE-2026-68752 | Hig | 0.47 | 7.2 | 0.00 | Aug 12, 2026 | A Project Resource Manager may gain broader administrative privileges under specific conditions. | ||
| CVE-2023-42661 | Hig | 0.47 | 7.2 | 0.01 | Mar 7, 2024 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts. | ||
| CVE-2019-19937 | Hig | 0.47 | 7.2 | 0.01 | Mar 16, 2020 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results." | ||
| CVE-2018-1000623 | Hig | 0.47 | 7.2 | 0.02 | Jul 9, 2018 | JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint… | ||
| CVE-2026-66384 | Med | 0.46 | 5.3 | 0.01 | KEV | Aug 12, 2026 | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | |
| CVE-2026-66016 | Med | 0.44 | 6.7 | 0.00 | Aug 12, 2026 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. | ||
| CVE-2018-1000424 | Hig | 0.44 | 7.8 | 0.00 | Jan 9, 2019 | An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it… | ||
| CVE-2026-68756 | Med | 0.43 | 6.6 | 0.00 | Aug 12, 2026 | A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | ||
| CVE-2023-42509 | Med | 0.43 | 6.6 | 0.00 | Mar 7, 2024 | JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data. | ||
| CVE-2026-70550 | Med | 0.42 | 6.5 | 0.00 | Aug 25, 2026 | An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed… | ||
| CVE-2026-68754 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | A repository publisher without delete permission may modify protected package content under specific conditions. | ||
| CVE-2023-42508 | Med | 0.42 | 6.5 | 0.00 | Oct 3, 2023 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body. | ||
| CVE-2020-2164 | Med | 0.42 | 6.5 | 0.01 | Mar 25, 2020 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system. | ||
| CVE-2021-45721 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to… | ||
| CVE-2021-45730 | Med | 0.39 | 6.0 | 0.01 | May 19, 2022 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators. |
- risk 0.53cvss 8.1epss 0.00
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
- risk 0.49cvss 7.6epss 0.00
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
- risk 0.49cvss 7.5epss 0.00
A user with access to a valid SAML response may impersonate another user under specific conditions.
- risk 0.49cvss 7.5epss 0.01
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- risk 0.47cvss 7.2epss 0.00
A holder of a valid integration credential may impersonate other users under specific conditions.
- risk 0.47cvss 7.2epss 0.00
A Project Resource Manager may gain broader administrative privileges under specific conditions.
- risk 0.47cvss 7.2epss 0.01
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.
- risk 0.47cvss 7.2epss 0.01
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."
- risk 0.47cvss 7.2epss 0.02
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint…
- risk 0.46cvss 5.3epss 0.01
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- risk 0.44cvss 6.7epss 0.00
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
- risk 0.44cvss 7.8epss 0.00
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it…
- risk 0.43cvss 6.6epss 0.00
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
- risk 0.43cvss 6.6epss 0.00
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
- risk 0.42cvss 6.5epss 0.00
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed…
- risk 0.42cvss 6.5epss 0.00
A repository publisher without delete permission may modify protected package content under specific conditions.
- risk 0.42cvss 6.5epss 0.00
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.
- risk 0.42cvss 6.5epss 0.01
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
- risk 0.40cvss 6.1epss 0.01
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to…
- risk 0.39cvss 6.0epss 0.01
JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.
Page 2 of 4