CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 2020%
High: 3737%
Medium: 4040%
Low or not scored: 22%

Matching CVEs: 99; Last two years
Critical: 20; CVSS 9.0 and above
High: 37; CVSS 7.0 to 8.9
Known exploited: 5; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 32 · August 2026

Most CVEs

In each company's software, last two years

Matching CVEs

10.0Crit
CVE-2026-120338 (opens in a new tab)
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120308 (opens in a new tab)
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files,
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120307 (opens in a new tab)
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120306 (opens in a new tab)
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant co
JFrog· Nov 1, 2026
9.0Crit
CVE-2026-92892 (opens in a new tab)
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
JFrog· Oct 13, 2026
9.8Crit
CVE-2026-105192 (opens in a new tab)
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless t
JFrog· Oct 7, 2026
6.3Med
CVE-2026-96456 (opens in a new tab)
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler t
JFrog· Sep 23, 2026
8.8High
CVE-2026-96455 (opens in a new tab)
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential. The endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a
JFrog· Sep 23, 2026
8.2High
CVE-2026-96454 (opens in a new tab)
Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with "remote": { "urls": ["https://*.*"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is "withGlobalTauri": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.
JFrog· Sep 23, 2026
7.7High
CVE-2026-95627 (opens in a new tab)
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.
JFrog· Sep 23, 2026
8.3High
CVE-2026-95626 (opens in a new tab)
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
JFrog· Sep 23, 2026
5.9Med
CVE-2026-95625 (opens in a new tab)
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
JFrog· Sep 23, 2026
6.8Med
CVE-2026-95624 (opens in a new tab)
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
JFrog· Sep 22, 2026
5.6Med
CVE-2026-95623 (opens in a new tab)
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
JFrog· Sep 22, 2026
9.8Crit
CVE-2026-90898 (opens in a new tab)
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image). transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
JFrog· Sep 14, 2026
7.8High
CVE-2026-90894 (opens in a new tab)
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
JFrog· Sep 14, 2026
8.1High
CVE-2026-86242 (opens in a new tab)
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for cust
JFrog· Sep 6, 2026
8.8High
CVE-2026-82642 (opens in a new tab)
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, treating it as an opaque string attribute, so an attacker who can get an <iframe> element to survive sanitization can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute when the browser renders the ifr
JFrog· Aug 30, 2026
8.8High
CVE-2026-82635 (opens in a new tab)
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the browser) and writes it to that path. A script that can invoke the command can overwrite user-writable files and install persistence (macOS LaunchAgents, Linux autostart, Windows Startup), leading to
JFrog· Aug 30, 2026
9.8Crit
CVE-2026-82329 (opens in a new tab)Known exploited
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
JFrog· Aug 28, 2026
6.5Med
CVE-2026-70550 (opens in a new tab)
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
JFrog· Aug 25, 2026
3.5Low
CVE-2026-70548 (opens in a new tab)
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.
JFrog· Aug 25, 2026
8.5High
CVE-2026-70551 (opens in a new tab)
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
JFrog· Aug 25, 2026
7.6High
CVE-2026-69104 (opens in a new tab)
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
JFrog· Aug 25, 2026
8.8High
CVE-2026-69106 (opens in a new tab)
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
JFrog· Aug 12, 2026
7.5High
CVE-2026-42018 (opens in a new tab)Known exploited
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-70547 (opens in a new tab)
An authenticated user without repository read permission may access package metadata under specific conditions.
JFrog· Aug 12, 2026
5.9Med
CVE-2026-69107 (opens in a new tab)
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
8.1High
CVE-2026-69105 (opens in a new tab)
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
JFrog· Aug 12, 2026
7.2High
CVE-2026-68759 (opens in a new tab)
A holder of a valid integration credential may impersonate other users under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68758 (opens in a new tab)
A low-privileged authenticated user may access restricted support information under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66384 (opens in a new tab)Known exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
JFrog· Aug 12, 2026
6.7Med
CVE-2026-66016 (opens in a new tab)
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
JFrog· Aug 12, 2026
3.1Low
CVE-2026-65926 (opens in a new tab)
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68760 (opens in a new tab)
An unauthenticated user may bypass authentication under specific cache conditions.
JFrog· Aug 12, 2026
7.5High
CVE-2026-68757 (opens in a new tab)
A user with access to a valid SAML response may impersonate another user under specific conditions.
JFrog· Aug 12, 2026
6.6Med
CVE-2026-68756 (opens in a new tab)
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-68755 (opens in a new tab)
A bundle writer may create misleading release promotion information under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68754 (opens in a new tab)
A repository publisher without delete permission may modify protected package content under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68753 (opens in a new tab)
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
JFrog· Aug 12, 2026
7.2High
CVE-2026-68752 (opens in a new tab)
A Project Resource Manager may gain broader administrative privileges under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66382 (opens in a new tab)
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66381 (opens in a new tab)
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66380 (opens in a new tab)
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66379 (opens in a new tab)
An authenticated user may view private Puppet module metadata without repository read access.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66378 (opens in a new tab)
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66377 (opens in a new tab)
An unauthenticated user may access restricted repository information under specific conditions.
JFrog· Aug 12, 2026
5.4Med
CVE-2026-66376 (opens in a new tab)
Credentials for a deleted user may remain valid for a short period under specific conditions.
JFrog· Aug 12, 2026
8.1High
CVE-2026-66375 (opens in a new tab)
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-66018 (opens in a new tab)
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).
JFrog· Jul 27, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.