CVE-2026-65925

CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...

CVE-2026-66018 JFrog Artifactory build environment properties exposure

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

EUVD-2026-49573

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...

PT-2026-65110

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

PT-2026-65116

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

PT-2026-65111

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

PT-2026-65113

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

PT-2026-65107

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A deserialization weakness exists in the way JFrog Artifactory handles packages. This flaw could allow a low-privileged user to compromise confidentiality, integrity, and availabili...

EUVD-2026-40117

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution...

GHSA-4RJ6-VRWV-WR8M Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...

EUVD-2026-48503

A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud...

EUVD-2024-55699

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2026-6924

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...