Artifactory
by Jfrog
Source repositories
CVEs (65)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-68752 | Hig | 0.47 | 7.2 | 0.00 | Aug 12, 2026 | A Project Resource Manager may gain broader administrative privileges under specific conditions. | ||
| CVE-2023-42661 | Hig | 0.47 | 7.2 | 0.01 | Mar 7, 2024 | JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts. | ||
| CVE-2019-19937 | Hig | 0.47 | 7.2 | 0.01 | Mar 16, 2020 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results." | ||
| CVE-2018-1000623 | Hig | 0.47 | 7.2 | 0.03 | Jul 9, 2018 | JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint… | ||
| CVE-2026-66016 | Med | 0.44 | 6.7 | 0.00 | Aug 12, 2026 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. | ||
| CVE-2026-68756 | Med | 0.43 | 6.6 | 0.00 | Aug 12, 2026 | A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | ||
| CVE-2023-42509 | Med | 0.43 | 6.6 | 0.00 | Mar 7, 2024 | JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data. | ||
| CVE-2026-68754 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | A repository publisher without delete permission may modify protected package content under specific conditions. | ||
| CVE-2023-42508 | Med | 0.42 | 6.5 | 0.00 | Oct 3, 2023 | JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body. | ||
| CVE-2020-2164 | Med | 0.42 | 6.5 | 0.01 | Mar 25, 2020 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system. | ||
| CVE-2021-45721 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to… | ||
| CVE-2021-45730 | Med | 0.39 | 6.0 | 0.01 | May 19, 2022 | JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators. | ||
| CVE-2026-69107 | Med | 0.38 | 5.9 | 0.00 | Aug 12, 2026 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. | ||
| CVE-2022-0668 | Med | 0.35 | 5.3 | 0.01 | Jan 8, 2023 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user. | ||
| CVE-2019-10324 | Med | 0.35 | 6.5 | 0.01 | May 31, 2019 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform… | ||
| CVE-2026-66384 | Med | 0.34 | 5.3 | 0.00 | Aug 12, 2026 | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | ||
| CVE-2026-68753 | Med | 0.34 | 5.3 | 0.00 | Aug 12, 2026 | An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. | ||
| CVE-2021-41834 | Med | 0.34 | 5.3 | 0.01 | May 23, 2022 | JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation. | ||
| CVE-2025-14830 | Med | 0.32 | 4.9 | 0.00 | Jan 4, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10. | ||
| CVE-2021-46687 | Med | 0.32 | 4.9 | 0.01 | Jul 6, 2022 | JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions… |
- risk 0.47cvss 7.2epss 0.00
A Project Resource Manager may gain broader administrative privileges under specific conditions.
- risk 0.47cvss 7.2epss 0.01
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.
- risk 0.47cvss 7.2epss 0.01
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."
- risk 0.47cvss 7.2epss 0.03
JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint…
- risk 0.44cvss 6.7epss 0.00
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
- risk 0.43cvss 6.6epss 0.00
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
- risk 0.43cvss 6.6epss 0.00
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
- risk 0.42cvss 6.5epss 0.00
A repository publisher without delete permission may modify protected package content under specific conditions.
- risk 0.42cvss 6.5epss 0.00
JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.
- risk 0.42cvss 6.5epss 0.01
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
- risk 0.40cvss 6.1epss 0.01
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to…
- risk 0.39cvss 6.0epss 0.01
JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.
- risk 0.38cvss 5.9epss 0.00
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
- risk 0.35cvss 5.3epss 0.01
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.
- risk 0.35cvss 6.5epss 0.01
A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform…
- risk 0.34cvss 5.3epss 0.00
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- risk 0.34cvss 5.3epss 0.01
JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.
- risk 0.32cvss 4.9epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10.
- risk 0.32cvss 4.9epss 0.01
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions…
Page 2 of 4