JFrog
In 10 briefs, most recently 14 September 2026. RSS for this tag
Learn more: Vulnerabilities (NVD) ↗
Known exploited (CISA KEV)
4 JFrog vulnerabilities are on CISA's list of vulnerabilities exploited in the wild. Most recent:
- CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability
- CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Coverage in DanSec Daily
- Revolut and Telus data breaches, a Twitch extension leaking OAuth tokens, and GitLab and ScreenConnect exploitation.
- Microsoft cloud account phishing and email-service fraud, CISA KEV adds for JFrog, ConnectWise and MikroTik, and Check Point VPN exploitation warnings.
- Florida DAVID driver database breach via stolen police credentials, Brevo platform compromise enabling phishing of Trezor users, and a critical GitLab path …
- Attackers chain JFrog Artifactory flaws for backdoors, GitLab and Check Point urge patches, and Cisco FMC flaws see ransomware exploitation.
- Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
- Aesto Health breach exposes 9.5M patients; SonicWall SMA 1000 zero-days exploited; Sality botnet dismantled by DOJ and partners.
- Berlin city data theft by Rhysida, McKesson breach claimed by ShinyHunters, and Cronos restart after $74M Tectonic exploit.
- Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
- OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
- The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.