AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JFrogCVE-2026-65618

JFrog artifactory: server-side request forgery

JFrog

CVE-2026-65618 · Published Jul 27, 2026 · updated Jul 30, 2026

Medium6.5
Fix: upgrade to 7.133.6 or later
JFrog advisory

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

Affected versions

PackageAffectedFixed in
artifactory
Product
< 7.133.67.133.6
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More JFrog advisories

All JFrog
Medium 6.5Jul 27JFrog artifactory: information disclosureCVE-2026-66018fixed in 7.146.34 +1High 8.8Jul 27JFrog artifactory: path traversalCVE-2026-65921fixed in 7.111.18 +3High 7.1Jul 27JFrog artifactory: missing authorizationCVE-2026-65922fixed in 7.111.18 +3Medium 6.8Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65923fixed in 7.111.18 +3Medium 6.5Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65924fixed in 7.111.18 +3Medium 6.5Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65925fixed in 7.111.18 +3