These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. This vulnerability has a CVSS score of 7.5 and is considered HIGH severity. Affected versions include those prior to 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8. Defenders should prioritize verifying and mitigating this vulnerabil [truncated]
JFrog Artifactory self-hosted versions before 7.133.11 are vulnerable to privilege escalation due to improper validation of token scope. This CVE was published on 2026-07-27T20:16:39.613Z and last modified on 2026-09-11T19:57:20.280Z. The NVD entry is currently Analyzed. The vulnerability allows attackers to potentially escalate privileges, emphasizing the need for defenders to verify and upgrade instance [truncated]
JFrog Artifactory Improper Authentication Vulnerability debrief. The vulnerability allows for authentication bypass, which could lead to unauthorized access and potential exploitation. Artifactory administrators and security teams should assess exposure and prioritize mitigation according to CISA guidance. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog, emphasizing th [truncated]
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability debrief. This vulnerability affects JFrog Artifactory, allowing attackers to traverse directories. Administrators and security teams should assess exposure and prioritize mitigation to prevent potential directory traversal issues. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Verif [truncated]
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. The vulnerability affects Artifactory versions prior to 7.146.28. Artifact repository administrators should verify and update their systems to prevent exploitation. This issue is particularly concerning for environments with low-privileged users who have access [truncated]
CVE-2026-70547 is a vulnerability in JFrog Artifactory that allows an authenticated user without repository read permission to access package metadata under specific conditions. This issue may impact data integrity and confidentiality, especially in environments with strict repository access controls. Defenders should assess exposure and verify the vulnerability in their environments, focusing on user per [truncated]
JFrog Artifactory restricted artifact access vulnerability allows unauthenticated users to access sensitive data under specific conditions, requiring immediate verification and potential remediation by administrators and security teams. This vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity, emphasizing the need for artifact inventory and access control assessment priority. The CV [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T16:17:15.540Z and has not been modified since then. CVE-2026-68758 is a medium-severity vulnerability (CVSS Score: 6.5) that allows a low-privileged authenticated user to access restricted support information under specific conditions. Organizations using products from JFrog and other vendors wit [truncated]
JFrog Artifactory self-hosted Helm configurations may retain generated TLS private keys in rendered manifests accessible to highly privileged local users. This vulnerability allows for potential exposure of sensitive information and could lead to unauthorized access. Administrators should assess the configuration and verify access controls to mitigate the risk. The issue arises from specific self-hosted H [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:22.603Z and has not been modified since then. CVE-2026-68760 is a medium-severity vulnerability allowing unauthenticated users to bypass authentication under specific cache conditions. The vulnerability has a CVSS score of 5.3 and is classified as CWE-287. Affected systems may require immed [truncated]
A party with write access to stored session data may affect JFrog Artifactory under specific conditions. The CVE record was published on 2026-08-12T15:18:22.360Z and was last modified on 2026-08-28T21:29:30.987Z. The NVD entry is currently Awaiting Analysis. This vulnerability allows a party with write access to stored session data to potentially affect JFrog Artifactory under specific conditions, with a [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:22.237Z and has not been modified since then. This CVE record indicates a potential vulnerability in JFrog Artifactory self-managed releases. Users of JFrog Artifactory self-managed releases, particularly those responsible for bundle writer release promotion information handling, should ver [truncated]
JFrog Artifactory users should be aware of a medium-severity vulnerability (CVE-2026-68754) that allows repository publishers without delete permissions to modify protected package content under specific conditions. This vulnerability has a CVSS score of 6.5 and requires review of configurations to ensure alignment with security policies. The CVE record was published on 2026-08-12T15:18:22.117Z and has no [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:20.203Z and has not been modified since then. CVE-2026-66382 is a medium-severity vulnerability in Artifactory that allows an authenticated user to write files outside the intended work directory under specific conditions. The vulnerability has a CVSS score of 4.3 and is classified as CWE-2 [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:19.967Z and has not been modified since then. CVE-2026-66380 is a medium severity vulnerability with a CVSS score of 4.3. An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. The vulnerability is characterized by CVSS:3 [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:19.847Z and has not been modified since then. This medium-severity vulnerability, CVE-2026-66379, allows authenticated users to view private Puppet module metadata without repository read access, with a CVSS score of 4.3. It affects Puppet modules, especially those with sensitive metadata. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:19.723Z and has not been modified since then. This vulnerability affects JFrog Artifactory users, administrators, and security teams. They should verify access controls and monitor for unauthorized access attempts. The vulnerability allows authenticated users without repository read permiss [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T15:18:19.597Z and has not been modified since then. CVE-2026-66377 is a medium-severity vulnerability allowing unauthenticated access to restricted repository information under specific conditions. The vulnerability has a CVSS score of 5.3 and is classified as CWE-862. Affected JFrog Artifactory [truncated]
JFrog Artifactory contains an authentication handling weakness in internal request processing. Under specific conditions, this weakness may allow an attacker to escalate privileges beyond the intended access level. Defenders should assess exposure and prioritize verification and updates to prevent potential privilege escalation. The CVE record and NVD entry provide details on the authentication handling w [truncated]
JFrog Artifactory (Workers) is vulnerable to Cross-Site Scripting (XSS), a type of Improper Neutralization of Input During Web Page Generation. This vulnerability affects Artifactory (Workers) versions from >=7.94.0 through <7.117.10. The issue allows attackers to inject malicious scripts, potentially leading to unauthorized actions or data breaches. Defenders should assess exposure and implement compensa [truncated]
