Priority LOW 30
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.0012 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-312
Priority LOW 34
A holder of a valid integration credential may impersonate other users under specific conditions.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00329 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-347
Priority LOW 15
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00243 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority HIGH 81KEV
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-22
Priority LOW 29
A low-privileged authenticated user may access restricted support information under specific conditions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00354 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 35
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00401 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 34
A user with access to a valid SAML response may impersonate another user under specific conditions.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00265 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-347
Priority LOW 32
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00469 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-502
Priority LOW 20
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00351 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-22
Priority LOW 24
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00385 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-22
Priority LOW 30
An unauthenticated user may bypass authentication under specific cache conditions.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00456 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-287
Priority LOW 20
An authenticated user may view private Puppet module metadata without repository read access.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 20
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 30
An unauthenticated user may access restricted repository information under specific conditions.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00359 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 20
A bundle writer may create misleading release promotion information under specific conditions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00264 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-863
Priority LOW 20
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 29
A repository publisher without delete permission may modify protected package content under specific conditions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00311 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 24
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00308 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-862
Priority LOW 24
Credentials for a deleted user may remain valid for a short period under specific conditions.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00221 · Published 2026-08-12 · Fixed in 7.146.35, 7.161.16 CWE-613
THREATIST.IORead the docs