JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Mô tả

Tham khảo

• docs.jfrog.com/releases/docs/artifactory-self-managed-releases · Release Notes
• docs.jfrog.com/releases/docs/jfrog-security-advisories · Vendor Advisory
• cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf · Technical Description
• openai.com/index/hugging-face-incident-and-the-road-ahead · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2026-66384

Lỗ hổng khác của artifactory

• CVE-2026-82329NGHIÊM TRỌNG 9.8ĐANG BỊ KHAI THÁC (CISA KEV)JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network …
• CVE-2026-69106CAO 8.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted con…
• CVE-2026-42018CAO 7.5ĐANG BỊ KHAI THÁC (CISA KEV)JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially …
• CVE-2026-70547TRUNG BÌNH 4.3An authenticated user without repository read permission may access package metadata under specific conditions.
• CVE-2026-69107TRUNG BÌNH 5.9An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.