CVEs.

Matching CVEs

1. 7.2High

   CVE-2026-66015 ↗ (opens in a new tab)

   An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.

   JFJFrog· Jul 27, 2026

2. 8.8High

   CVE-2026-66014 ↗ (opens in a new tab)

   JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

   JFJFrog· Jul 27, 2026

3. 6.5Med

   CVE-2026-65925 ↗ (opens in a new tab)

   A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

   JFJFrog· Jul 27, 2026

4. 6.5Med

   CVE-2026-65924 ↗ (opens in a new tab)

   JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

   JFJFrog· Jul 27, 2026

5. 6.8Med

   CVE-2026-65923 ↗ (opens in a new tab)

   A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.

   JFJFrog· Jul 27, 2026

6. 5.4Med

   CVE-2026-65922 ↗ (opens in a new tab)

   An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

   JFJFrog· Jul 27, 2026

7. 8.8High

   CVE-2026-65921 ↗ (opens in a new tab)

   A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.

   JFJFrog· Jul 27, 2026

8. 6.5Med

   CVE-2026-65618 ↗ (opens in a new tab)

   Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

   JFJFrog· Jul 27, 2026

9. 8.8High

   CVE-2026-65617 ↗ (opens in a new tab)

   A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

   JFJFrog· Jul 27, 2026

10. 8.8High

    CVE-2026-65616 ↗ (opens in a new tab)

    Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

    JFJFrog· Jul 27, 2026

11. 8.8High

    CVE-2026-42017 ↗ (opens in a new tab)

    An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.

    JFJFrog· Jul 27, 2026

12. 8.8High

    CVE-2026-42016 ↗ (opens in a new tab)Known exploited

    JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

    JFJFrog· Jul 27, 2026

13. 5.5Med

    CVE-2026-17534 ↗ (opens in a new tab)

    Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call

    JFJFrog· Jul 27, 2026

14. 8.3High

    CVE-2026-17497 ↗ (opens in a new tab)

    NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.

    JFJFrog· Jul 26, 2026

15. 8.1High

    CVE-2026-17496 ↗ (opens in a new tab)

    NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the

    JFJFrog· Jul 26, 2026

16. 8.8High

    CVE-2026-8461 ↗ (opens in a new tab)

    An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

    JFJFrog· Jun 18, 2026

17. 5.8Med

    CVE-2026-25905 ↗ (opens in a new tab)

    The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.

    JFJFrog· Feb 9, 2026

18. 5.8Med

    CVE-2026-25904 ↗ (opens in a new tab)

    The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.

    JFJFrog· Feb 9, 2026

19. 9.9Crit

    CVE-2026-1470 ↗ (opens in a new tab)

    n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operatio

    JFJFrog· Jan 27, 2026

20. 9.9Crit

    CVE-2026-0863 ↗ (opens in a new tab)

    Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significan

    JFJFrog· Jan 18, 2026

21. 4.9Med

    CVE-2025-14830 ↗ (opens in a new tab)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10.

    JFJFrog· Jan 4, 2026

22. 7.5High

    CVE-2025-14542 ↗ (opens in a new tab)

    The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual (e.g., one defining an HTTP tool call), earning the clients’ trust, a malicious provider can later change the manual to exploit the client.

    JFJFrog· Dec 13, 2025

23. 7.1High

    CVE-2025-14261 ↗ (opens in a new tab)

    The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.

    JFJFrog· Dec 8, 2025

24. 5.9Med

    CVE-2025-12695 ↗ (opens in a new tab)

    The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.

    JFJFrog· Nov 4, 2025

25. 9.8Crit

    CVE-2025-11953 ↗ (opens in a new tab)Known exploited

    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

    JFJFrog· Nov 3, 2025

26. 6.8Med

    CVE-2025-6515 ↗ (opens in a new tab)

    The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server.

    JFJFrog· Oct 20, 2025

27. 8.1High

    CVE-2025-10854 ↗ (opens in a new tab)

    The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhere in the filesystem when txtai is used to load untrusted embedding indices

    JFJFrog· Sep 22, 2025

28. 9.3Crit

    CVE-2025-10157 ↗ (opens in a new tab)

    A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

    JFJFrog· Sep 17, 2025

29. 9.3Crit

    CVE-2025-10156 ↗ (opens in a new tab)

    An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

    JFJFrog· Sep 17, 2025

30. 9.3Crit

    CVE-2025-10155 ↗ (opens in a new tab)

    An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

    JFJFrog· Sep 17, 2025

31. 9.8Crit

    CVE-2025-59361 ↗ (opens in a new tab)

    The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    JFJFrog· Sep 15, 2025

32. 9.8Crit

    CVE-2025-59360 ↗ (opens in a new tab)

    The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    JFJFrog· Sep 15, 2025

33. 9.8Crit

    CVE-2025-59359 ↗ (opens in a new tab)

    The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    JFJFrog· Sep 15, 2025

34. 7.5High

    CVE-2025-59358 ↗ (opens in a new tab)

    The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

    JFJFrog· Sep 15, 2025

35. 7.6High

    CVE-2025-9959 ↗ (opens in a new tab)

    Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code.

    JFJFrog· Sep 3, 2025

36. 9.8Crit

    CVE-2025-8943 ↗ (opens in a new tab)

    The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.

    JFJFrog· Aug 14, 2025

37. 9.8Crit

    CVE-2025-55346 ↗ (opens in a new tab)

    User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

    JFJFrog· Aug 14, 2025

38. 8.8High

    CVE-2025-55345 ↗ (opens in a new tab)

    Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.

    JFJFrog· Aug 13, 2025

39. 9.6Crit

    CVE-2025-6514 ↗ (opens in a new tab)

    mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL

    JFJFrog· Jul 9, 2025

40. 6.5Med

    CVE-2025-32949 ↗ (opens in a new tab)

    This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource ex

    JFJFrog· Apr 15, 2025

41. 7.5High

    CVE-2025-32948 ↗ (opens in a new tab)

    The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to create crafted playlists which will cause either denial of service or an attacker-controlled blind SSRF.

    JFJFrog· Apr 15, 2025

42. 7.5High

    CVE-2025-32947 ↗ (opens in a new tab)

    This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities.

    JFJFrog· Apr 15, 2025

43. 5.3Med

    CVE-2025-32946 ↗ (opens in a new tab)

    This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

    JFJFrog· Apr 15, 2025

44. 4.3Med

    CVE-2025-32945 ↗ (opens in a new tab)

    The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

    JFJFrog· Apr 15, 2025

45. 6.5Med

    CVE-2025-32944 ↗ (opens in a new tab)

    The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.

    JFJFrog· Apr 15, 2025

46. 4.3Med

    CVE-2025-32943 ↗ (opens in a new tab)

    The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.

    JFJFrog· Apr 15, 2025

47. 8.1High

    CVE-2025-3445 ↗ (opens in a new tab)

    A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be ov

    JFJFrog· Apr 13, 2025

48. 7.0High

    CVE-2024-27134 ↗ (opens in a new tab)

    Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

    JFJFrog· Nov 25, 2024

49. 6.5Med

    CVE-2024-10524 ↗ (opens in a new tab)

    Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

    JFJFrog· Nov 19, 2024