CVE-2020-7931

CVE-2020-7931: SSTI exploitation in Artifactory Pro CVE-2020-7931 is somewhat of a purposeful misconfiguration vulnerability in Artifactory that lets attackers conduct server-side template injections from a FreeMarker template. The vulnerability was discovered by Ryan Hanson from Atredis and was...

CVE-2026-82329-PoC-Exploit

CVE‑2026‑82329 – JFrog Artifactory Auth Bypass Toolkit ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse A...

cve-2026-82329-jfrog-artifactory

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass → admin takeover CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-287 · disclosed 2026-08-28 · exploited in the wild. An unauthenticated, network-adjacent attacker mints a platform administrator access token against a default...

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass

JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled. id:...

JFrog_CVE-2026-65615-ByGLM

JFrog Artifactory Pre-Auth RCE Full Chain Reproduction CVE-2026-42018 / CVE-2026-65616 / CVE-2026-65615 For authorized security testing, defensive research, and security education only. This vulnerability chain has been fixed by the vendor upgrading to 7.161.15+ is recommended. Please reproduce...

CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory Unauthenticated Authentication Bypass Mass Exploit -red.svg Critical Authentication Bypass CVSS 9.8 — Actively Exploited in the Wild This tool is a mass exploit for CVE-2026-82329, a vulnerability that allows an unauthenticated attacker with network access to...

artifactory-CVE-2026-82329-poc.py

This repository does not have a README...

CVE-2026-82329-poc

CVE-2026-82329 Artifactory Security Assessment Tool PoC and validation tool to identify self-hosted JFrog Artifactory installations affected by CVE-2026-82329. This tool validates the following authentication chain: 1. Create an HS256 JWT join using the default empty signing key. 2. Send the JWT ...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

CVE-2026-82329-JFrog-Artifactory-

CVE-2026-82329-JFrog-Artifactory- CVE-2026-82329 — JFrog Artifactory Auth Bypass The Vulnerability Critical authentication bypass in JFrog Artifactory versions 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.37, 7.161.19. The flaw allows an unauthenticated attacker to forge a JWT using a blank HMAC...

JFrog Artifactory < 7.104.16 / 7.111.x < 7.111.14 / 7.117.x < 7.117.21 / 7.125.x < 7.125.14 / 7.133.x < 7.133.21 / 7.146.x < 7.146.8 Information Disclosure

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.104.16, 7.111.x prior to 7.111.14, 7.117.x prior to 7.117.21, 7.125.x prior to 7.125.14, 7.133.x prior to 7.133.21, or 7.146.x prior to 7.146.8. It is, therefore, affected by...

JFrog Artifactory < 7.146.28 Cache Poisoning

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.28. It is, therefore, affected by a cache poisoning vulnerability in the cached artifact metadata. An authenticated, remote attacker can exploit this to potentially cause...

JFrog Artifactory < 7.146.27 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.27. It is, therefore, affected by a privilege escalation vulnerability in the refresh-token signature due to incorrect validation. An authenticated, remote attacker can...

JFrog Artifactory 7.117.x < 7.117.25 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

JFrog Artifactory < 7.111.18 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

JFrog Artifactory < 7.133.21 / 7.146.x < 7.146.8 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.21, or 7.146.x prior to 7.146.8. It is, therefore, affected by a privilege escalation vulnerability in event-handling. An authenticated, remote attacker can exploit this ...

JFrog Artifactory 7.94.x < 7.117.10 XSS

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.94.x prior to 7.117.10. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An...

JFrog Artifactory 7.133.x < 7.133.27 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

JFrog Artifactory 7.125.x < 7.125.18 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...