{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:30.601Z","products":["jfrog"],"actNowTotal":3,"results":[{"query":"jfrog","matched":3,"actNow":3,"events":[{"id":"kev-2026-09-11-jfrog-artifactory","url":"https://securitythreatpulse.com/events/kev-2026-09-11-jfrog-artifactory","title":"JFrog Artifactory: 2 flaws used in attacks; attackers can gain admin rights","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 90 days old, so many systems are likely still unpatched. Ready-made attack tools are public.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-42016","CVE-2026-42018"],"vendor":"JFrog","product":"Artifactory","affectedProducts":[{"kind":"direct","slug":"jfrog/artifactory","vendor":"JFrog","product":"Artifactory","evidence":["kev","cpe"],"vendorKey":"jfrog","productKey":"artifactory"}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","cvss":8.1,"epss":0.09983,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-11","kevDueDate":"2026-09-25","firstSeenAt":"2026-09-11T00:00:00.000Z","updatedAt":"2026-11-10T18:00:06.591Z","newestEvidenceAt":"2026-11-08T00:00:08.000Z"},{"id":"kev-2026-09-02-jfrog-artifactory","url":"https://securitythreatpulse.com/events/kev-2026-09-02-jfrog-artifactory","title":"JFrog Artifactory: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 65 days old, so current versions are being attacked. Ready-made attack tools are public. The severity score is critical (9.8).","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-82329"],"vendor":"JFrog","product":"Artifactory","affectedProducts":[{"vendorKey":"jfrog","productKey":"artifactory","vendor":"JFrog","product":"Artifactory","slug":"jfrog/artifactory","kind":"direct","evidence":["kev"]}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.","cvss":9.8,"epss":0.14372,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-02","kevDueDate":"2026-09-05","firstSeenAt":"2026-09-02T00:00:00.000Z","updatedAt":"2026-11-01T18:37:40.206Z","newestEvidenceAt":"2026-10-24T23:23:07.997Z"},{"id":"kev-2026-08-27-jfrog-artifactory","url":"https://securitythreatpulse.com/events/kev-2026-08-27-jfrog-artifactory","title":"JFrog Artifactory: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 75 days old, so current versions are being attacked.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-66384"],"vendor":"JFrog","product":"Artifactory","affectedProducts":[{"vendorKey":"jfrog","productKey":"artifactory","vendor":"JFrog","product":"Artifactory","slug":"jfrog/artifactory","kind":"direct","evidence":["kev"]}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","cvss":5.3,"epss":0.00665,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-08-27","kevDueDate":"2026-09-10","firstSeenAt":"2026-08-27T00:00:00.000Z","updatedAt":"2026-10-26T15:22:40.236Z","newestEvidenceAt":"2026-08-28T16:06:44.000Z"}]}]}