JFrog

Latest CVEs · RSS

• CVE-2026-92892 2026-10-13 · CVSS 9.0
  Potential arbitrary code execution, under specific configurations.
• CVE-2026-105192 2026-10-07 · CVSS 9.8
  LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Mess
• CVE-2026-96456 2026-09-23 · CVSS 6.3
  The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an at
• CVE-2026-96455 2026-09-23 · CVSS 8.8
  The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.
• CVE-2026-96454 2026-09-23 · CVSS 8.2
  Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together th
• CVE-2026-95627 2026-09-23 · CVSS 7.7
  When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursi
• CVE-2026-95626 2026-09-23 · CVSS 8.3
  Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data
• CVE-2026-95625 2026-09-23 · CVSS 5.9
  The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which co
• CVE-2026-95624 2026-09-22 · CVSS 6.8
  The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replace
• CVE-2026-95623 2026-09-22 · CVSS 5.6
  The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server re
• CVE-2026-90898 2026-09-14 · CVSS 9.8
  Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clien
• CVE-2026-90894 2026-09-14 · CVSS 7.8
  Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts
• CVE-2026-86242 2026-09-06 · CVSS 8.1
  Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authent
• CVE-2026-82642 2026-08-30 · CVSS 8.8
  Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that f
• CVE-2026-82635 2026-08-30 · CVSS 8.8
  Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filena
• CVE-2026-82329 2026-08-28 · CVSS 9.8
  JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain adm
• CVE-2026-70550 2026-08-25 · CVSS 6.5
  An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata
• CVE-2026-70548 2026-08-25 · CVSS 3.5
  Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.
• CVE-2026-69104 2026-08-25 · CVSS 7.6
  An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthor
• CVE-2026-70551 2026-08-25 · CVSS 8.5
  A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
• CVE-2026-69106 2026-08-12 · CVSS 8.8
  A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
• CVE-2026-42018 2026-08-12 · CVSS 7.5
  JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive r
• CVE-2026-69107 2026-08-12 · CVSS 5.9
  An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
• CVE-2026-69105 2026-08-12 · CVSS 8.1
  An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabilit
• CVE-2026-70547 2026-08-12 · CVSS 4.3
  An authenticated user without repository read permission may access package metadata under specific conditions.