Product by JFrog
Artifactory Self-managed
25 known vulnerabilities in Artifactory Self-managed (JFrog), 2 of them actively exploited (CISA KEV).
Key figures
25
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-42018 | Anonymous user token generation exposure in JFrog Artifactory In CISA KEValso in 2 other products | 7.5 | |
| Critical | CVE-2026-66384 | Authenticated users may write data outside the intended Docker cache path In CISA KEValso in 2 other products | 5.3 | |
| High | CVE-2026-69106 | Potential cache poisoning in JFrog Artifactory | 8.8 | |
| High | CVE-2026-68752 | Project Resource Managers may escalate privileges in JFrog Artifactory | 7.2 | |
| High | CVE-2026-66375 | Low-privilege users may remove protected Artifactory metadata | 8.1 | |
| Medium | CVE-2026-68756 | Potential insecure deserialization in JFrog Artifactory | 6.6 | |
| High | CVE-2026-69105 | Potential package cache integrity issue in JFrog Artifactory | 8.1 | |
| High | CVE-2026-68759 | Integration credential holders may impersonate users in JFrog Access | 7.2 | |
| High | CVE-2026-68757 | Potential improper SAML signature verification in JFrog Artifactory | 7.5 | |
| Medium | CVE-2026-69107 | Potential unauthorized artifact access in JFrog Artifactory | 5.9 | |
| Medium | CVE-2026-68758 | Authenticated users may access restricted Artifactory support information | 6.5 | |
| Medium | CVE-2026-68760 | Potential remember-me authentication bypass in JFrog Artifactory | 5.3 | |
| Medium | CVE-2026-68754 | Publishers without delete permission can overwrite docker layer information | 6.5 | |
| Medium | CVE-2026-66381 | Repository readers may access content outside configured upstream paths | 5.3 | |
| Medium | CVE-2026-66016 | Rendered Artifactory Helm manifests may contain generated TLS private keys | 6.7 | |
| Medium | CVE-2026-66377 | Anonymous users may access restricted Artifactory repository information | 5.3 | |
| Medium | CVE-2026-68753 | Anonymous users may access restricted Artifactory content under specific configurations | 5.3 | |
| Medium | CVE-2026-66376 | Deleted users may temporarily retain access to JFrog Artifactory | 5.4 | |
| Medium | CVE-2026-66382 | Authenticated users may write files outside the intended Artifactory work directory | 4.3 | |
| Medium | CVE-2026-66380 | Authenticated users may access private OCI referrer metadata | 4.3 | |
| Medium | CVE-2026-66379 | Authenticated users may view private Puppet module metadata | 4.3 | |
| Medium | CVE-2026-66378 | Authenticated users may access private NuGet metadata | 4.3 | |
| Medium | CVE-2026-70547 | Potential unauthorized metadata exposure in JFrog Artifactory | 4.3 | |
| Medium | CVE-2026-68755 | Bundle writers may alter trusted release information in JFrog Artifactory | 4.3 | |
| Low | CVE-2026-65926 | Private Release Bundle versions may be disclosed under specific configurations | 3.1 |