PT-2026-65102

Name of the Vulnerable Software and Affected Versions JFrog Artifactory Self Hosted versions prior to 7.133.11 Description An incorrect authorization validation of the user token allows for privilege escalation. The issue occurs because the system performs a validation check on the token signatur...

PT-2026-65108

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

[SECURITY] Fedora 44 Update: jfrog-cli-2.112.0-1.fc44

JFrog CLI is a client that provides a simple interface that automates access to the JFrog products...

Fedora 44 : jfrog-cli (2026-a5e27945f7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5e27945f7 advisory. Update to 2.112.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Malicious Package

Overview solana-mev-bot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solana-web3-py is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solana-web3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview solana-js-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @solana-labs/web3.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solana-web3-stable is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

jfrog-cli-2.104.1-1.1 on GA media (moderate)

jfrog-cli-2.104.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10844-1 Rating: moderate Cross-References: CVE-2025-11579 CVSS scores: CVE-2025-11579 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-11579 SUSE : 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA...

OPENSUSE-SU-2026:10844-1 jfrog-cli-2.104.1-1.1 on GA media

These are all security issues fixed in the jfrog-cli-2.104.1-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in zest-product (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9081ad708b658c1bd56299e401ca6a764cc9137d99573bc922d38a7381cc30d On npm install, postinstall.js collects host identity and environment data os.hostname, username, process.cwd, process.env values, plus shelled-out...

Malicious Package

Overview @kindo/selfbot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: nfpm, kubescape-server, kaniko, argo-events, src-fingerprint-fips, wolfictl, melange, gitlab-rails-ce, syft-fips, kaniko-fips, grafana, upwind-agent, gitea-fips, gitaly-fips, pulumi-language-dotnet, chainctl-fips, redpanda-console, crossplane-fips, src-fingerprint,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: nfpm, kubescape-server, kaniko, argo-events, src-fingerprint-fips, wolfictl, melange, gitlab-rails-ce, syft-fips, kaniko-fips, grafana, upwind-agent, gitea-fips, gitaly-fips, pulumi-language-dotnet, chainctl-fips, redpanda-console, crossplane-fips, src-fingerprint,...

[SECURITY] Fedora 44 Update: jfrog-cli-2.98.0-1.fc44

JFrog CLI is a client that provides a simple interface that automates access to the JFrog products...

Fedora 44 : jfrog-cli (2026-6b87863841)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b87863841 advisory. Upstream release 2.98.0. https://github.com/jfrog/jfrog-cli/releases/tag/v2.98.0 Resolves the following security issues: CVE-2025-11579 CVE-2025-665...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: chart-testing-fips, chaos-mesh, helm-diff-fips, kubescape-server, envoy-gateway, chartmuseum, harbor-fips, cert-manager-cmctl-fips, cerbos, istio, rancher-fleet, cluster-api-helm-controller-fips, k9s-fips, teleport, helm-operator, cluster-api-helm-controller,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: localstack, kubescape-server, istio, malcontent, gitlab-rails-ce, rabbitmq-messaging-topology-operator, aws-flb-firehose, cilium-envoy-fips, cilium-cli, kube-mgmt-fips, cloudflared-fips, splunk-otel-collector, gitea-fips, podman, gitaly-fips, gitlab-pages, redpanda,...