https://vulnogram.org/ Most recent CVEs assigned by JFrog (jfrog). https://vulnogram.org/seaview/icons/jfrog.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-92892 https://vulnogram.org/CVE-2026-92892 Potential arbitrary code execution, under specific configurations. Critical Network Exploitable Tue, 13 Oct 2026 17:47:43 GMT https://vulnogram.org/CVE-2026-105192 https://vulnogram.org/CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserializ… Critical Network Exploitable Wed, 07 Oct 2026 09:40:11 GMT https://vulnogram.org/CVE-2026-96456 https://vulnogram.org/CVE-2026-96456 The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The… Medium Wed, 23 Sep 2026 10:03:06 GMT https://vulnogram.org/CVE-2026-96455 https://vulnogram.org/CVE-2026-96455 The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), whic… High Wed, 23 Sep 2026 10:01:15 GMT https://vulnogram.org/CVE-2026-96454 https://vulnogram.org/CVE-2026-96454 Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilit… High Network Exploitable Wed, 23 Sep 2026 09:56:32 GMT https://vulnogram.org/CVE-2026-95627 https://vulnogram.org/CVE-2026-95627 When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a… High Wed, 23 Sep 2026 09:43:04 GMT https://vulnogram.org/CVE-2026-95626 https://vulnogram.org/CVE-2026-95626 Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme so… High Network Exploitable Wed, 23 Sep 2026 09:33:09 GMT https://vulnogram.org/CVE-2026-95625 https://vulnogram.org/CVE-2026-95625 The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never… Medium Wed, 23 Sep 2026 08:51:53 GMT https://vulnogram.org/CVE-2026-95624 https://vulnogram.org/CVE-2026-95624 The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Becaus… Medium Network Exploitable Tue, 22 Sep 2026 17:16:25 GMT https://vulnogram.org/CVE-2026-95623 https://vulnogram.org/CVE-2026-95623 The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-check… Medium Tue, 22 Sep 2026 10:52:20 GMT https://vulnogram.org/CVE-2026-90898 https://vulnogram.org/CVE-2026-90898 Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=fa… Critical Network Exploitable Mon, 14 Sep 2026 10:18:53 GMT https://vulnogram.org/CVE-2026-90894 https://vulnogram.org/CVE-2026-90894 Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppl… High Mon, 14 Sep 2026 09:52:43 GMT https://vulnogram.org/CVE-2026-86242 https://vulnogram.org/CVE-2026-86242 Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-obj… High Network Exploitable Sun, 06 Sep 2026 11:20:11 GMT https://vulnogram.org/CVE-2026-82642 https://vulnogram.org/CVE-2026-82642 Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/tr… High Network Exploitable Sun, 30 Aug 2026 13:44:34 GMT https://vulnogram.org/CVE-2026-82635 https://vulnogram.org/CVE-2026-82635 Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist… High Network Exploitable Sun, 30 Aug 2026 12:26:16 GMT https://vulnogram.org/CVE-2026-82329 https://vulnogram.org/CVE-2026-82329 JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Critical Known Exploited Network Exploitable Fri, 28 Aug 2026 18:27:43 GMT https://vulnogram.org/CVE-2026-70550 https://vulnogram.org/CVE-2026-70550 An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and… Medium Tue, 25 Aug 2026 15:22:53 GMT https://vulnogram.org/CVE-2026-70548 https://vulnogram.org/CVE-2026-70548 Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. Low Tue, 25 Aug 2026 15:17:16 GMT https://vulnogram.org/CVE-2026-69104 https://vulnogram.org/CVE-2026-69104 An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue. High Tue, 25 Aug 2026 15:09:29 GMT https://vulnogram.org/CVE-2026-70551 https://vulnogram.org/CVE-2026-70551 A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. High Tue, 25 Aug 2026 15:06:48 GMT https://vulnogram.org/CVE-2026-69106 https://vulnogram.org/CVE-2026-69106 A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. High Wed, 12 Aug 2026 17:48:29 GMT https://vulnogram.org/CVE-2026-42018 https://vulnogram.org/CVE-2026-42018 JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. High Known Exploited Network Exploitable Wed, 12 Aug 2026 17:43:21 GMT https://vulnogram.org/CVE-2026-69107 https://vulnogram.org/CVE-2026-69107 An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions. Medium Network Exploitable Wed, 12 Aug 2026 15:51:47 GMT https://vulnogram.org/CVE-2026-69105 https://vulnogram.org/CVE-2026-69105 An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability. High Network Exploitable Wed, 12 Aug 2026 15:19:40 GMT https://vulnogram.org/CVE-2026-70547 https://vulnogram.org/CVE-2026-70547 An authenticated user without repository read permission may access package metadata under specific conditions. Medium Wed, 12 Aug 2026 15:18:29 GMT https://vulnogram.org/CVE-2026-66016 https://vulnogram.org/CVE-2026-66016 Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. Medium Wed, 12 Aug 2026 15:16:39 GMT https://vulnogram.org/CVE-2026-68759 https://vulnogram.org/CVE-2026-68759 A holder of a valid integration credential may impersonate other users under specific conditions. High Wed, 12 Aug 2026 15:15:50 GMT https://vulnogram.org/CVE-2026-65926 https://vulnogram.org/CVE-2026-65926 An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known. Low Wed, 12 Aug 2026 15:14:42 GMT https://vulnogram.org/CVE-2026-66384 https://vulnogram.org/CVE-2026-66384 An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. Medium Known Exploited Wed, 12 Aug 2026 15:14:04 GMT https://vulnogram.org/CVE-2026-68758 https://vulnogram.org/CVE-2026-68758 A low-privileged authenticated user may access restricted support information under specific conditions. Medium Wed, 12 Aug 2026 15:12:56 GMT https://vulnogram.org/CVE-2026-66375 https://vulnogram.org/CVE-2026-66375 A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. High Wed, 12 Aug 2026 15:11:35 GMT https://vulnogram.org/CVE-2026-68757 https://vulnogram.org/CVE-2026-68757 A user with access to a valid SAML response may impersonate another user under specific conditions. High Wed, 12 Aug 2026 15:10:23 GMT https://vulnogram.org/CVE-2026-68756 https://vulnogram.org/CVE-2026-68756 A party with write access to stored session data may affect JFrog Artifactory under specific conditions. Medium Wed, 12 Aug 2026 15:09:21 GMT https://vulnogram.org/CVE-2026-66382 https://vulnogram.org/CVE-2026-66382 An authenticated user may write files outside the intended Artifactory work directory under specific conditions. Medium Wed, 12 Aug 2026 15:08:11 GMT https://vulnogram.org/CVE-2026-66381 https://vulnogram.org/CVE-2026-66381 A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. Medium Wed, 12 Aug 2026 15:07:01 GMT https://vulnogram.org/CVE-2026-68760 https://vulnogram.org/CVE-2026-68760 An unauthenticated user may bypass authentication under specific cache conditions. Medium Network Exploitable Wed, 12 Aug 2026 15:04:59 GMT https://vulnogram.org/CVE-2026-66379 https://vulnogram.org/CVE-2026-66379 An authenticated user may view private Puppet module metadata without repository read access. Medium Wed, 12 Aug 2026 15:03:03 GMT https://vulnogram.org/CVE-2026-66378 https://vulnogram.org/CVE-2026-66378 An authenticated user without repository read permission may access private NuGet metadata under specific conditions. Medium Wed, 12 Aug 2026 15:02:08 GMT https://vulnogram.org/CVE-2026-66377 https://vulnogram.org/CVE-2026-66377 An unauthenticated user may access restricted repository information under specific conditions. Medium Network Exploitable Wed, 12 Aug 2026 15:00:49 GMT https://vulnogram.org/CVE-2026-68755 https://vulnogram.org/CVE-2026-68755 A bundle writer may create misleading release promotion information under specific conditions. Medium Wed, 12 Aug 2026 15:00:06 GMT https://vulnogram.org/CVE-2026-66380 https://vulnogram.org/CVE-2026-66380 An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. Medium Wed, 12 Aug 2026 14:59:24 GMT https://vulnogram.org/CVE-2026-68754 https://vulnogram.org/CVE-2026-68754 A repository publisher without delete permission may modify protected package content under specific conditions. Medium Wed, 12 Aug 2026 14:58:43 GMT https://vulnogram.org/CVE-2026-68753 https://vulnogram.org/CVE-2026-68753 An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. Medium Wed, 12 Aug 2026 14:57:38 GMT https://vulnogram.org/CVE-2026-66376 https://vulnogram.org/CVE-2026-66376 Credentials for a deleted user may remain valid for a short period under specific conditions. Medium Wed, 12 Aug 2026 14:55:59 GMT https://vulnogram.org/CVE-2026-68752 https://vulnogram.org/CVE-2026-68752 A Project Resource Manager may gain broader administrative privileges under specific conditions. High Wed, 12 Aug 2026 14:55:01 GMT https://vulnogram.org/CVE-2026-65922 https://vulnogram.org/CVE-2026-65922 An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availab… High Mon, 27 Jul 2026 19:44:44 GMT https://vulnogram.org/CVE-2026-65923 https://vulnogram.org/CVE-2026-65923 A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has be… Medium Mon, 27 Jul 2026 19:43:46 GMT https://vulnogram.org/CVE-2026-65617 https://vulnogram.org/CVE-2026-65617 A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions. High Mon, 27 Jul 2026 19:37:27 GMT https://vulnogram.org/CVE-2026-65924 https://vulnogram.org/CVE-2026-65924 JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifac… Medium Mon, 27 Jul 2026 19:36:35 GMT https://vulnogram.org/CVE-2026-65925 https://vulnogram.org/CVE-2026-65925 A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. Medium Mon, 27 Jul 2026 19:35:17 GMT