Vendor
JFrog
80 known vulnerabilities in products by JFrog, 4 of them actively exploited (CISA KEV).
Key figures
80
Vulnerabilities
4
Actively exploited (KEV)
0
Used by ransomware
14
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-82329 | Potential authentication bypass leading to administrative access in Artifactory In CISA KEV | 9.8 | |
| Critical | CVE-2026-42016 | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation In CISA KEV | 8.8 | |
| Critical | CVE-2026-42018 | Anonymous user token generation exposure in JFrog Artifactory In CISA KEV | 7.5 | |
| Critical | CVE-2026-66384 | Authenticated users may write data outside the intended Docker cache path In CISA KEV | 5.3 | |
| Critical | CVE-2019-17444 | JFrog Artifactory does not enforce default admin password change | 9.8 | |
| Critical | CVE-2019-9733 | JFrog Artifactory: security vulnerability | 9.8 | |
| Critical | CVE-2016-10036 | JFrog Artifactory: Unrestricted File Upload | 9.8 | |
| Critical | CVE-2016-6501 | JFrog Artifactory: Code Execution | 9.8 | |
| High | CVE-2020-7931 | JFrog Artifactory: Remote Code Execution | 8.8 | |
| Critical | CVE-2018-19971 | JFrog Artifactory: Improper Access Control | 9.8 | |
| High | CVE-2022-0573 | JFrog Artifactory: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2018-1000623 | JFrog Artifactory: Path Traversal | 7.2 | |
| High | CVE-2026-65617 | JFrog Artifactory: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2026-66014 | Potential authentication bypass leading to privilege escalation in Artifactory | 8.8 | |
| High | CVE-2026-65921 | Potential path traversal leading to unauthorized file writes | 8.8 | |
| High | CVE-2026-69106 | Potential cache poisoning in JFrog Artifactory | 8.8 | |
| High | CVE-2026-42017 | Privilege escalation via JFrog Worker event token exposure | 8.8 | |
| Critical | CVE-2026-92892 | Jfrog-cli: Argument Injection | 9.0 | |
| High | CVE-2019-19937 | JFrog Artifactory: security vulnerability | 7.2 | |
| High | CVE-2021-3860 | JFrog Artifactory: SQL Injection | 8.8 | |
| High | CVE-2026-66015 | JFrog Artifactory: Improper Privilege Management | 7.2 | |
| High | CVE-2026-65616 | Potential privilege escalation to JFrog administrator privileges | 8.8 | |
| High | CVE-2026-68752 | Project Resource Managers may escalate privileges in JFrog Artifactory | 7.2 | |
| High | CVE-2026-66375 | Low-privilege users may remove protected Artifactory metadata | 8.1 | |
| Critical | CVE-2024-4142 | JFrog Artifactory Improper input validation within token creation flow | 9.0 |
News
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVthehackernews,
- Hackers exploit critical JFrog Artifactory flaw to forge admin tokensbleepingcomputer,
- Exploited JFrog Artifactory bug puts software supply chain on alertcsoonline,
- Attackers Pounce on Critical Artifactory Bug Following Disclosuredarkreading,
- Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosurethehackernews,
- Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wildsecurityweek,
Products
| JFrog Artifactory | 78 | 4 |
| Artifactory Saas | 25 | 2 |
| Artifactory Self-managed | 25 | 2 |
| Jfrog Artifactory | 8 | 0 |