AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JFrogCVE-2026-65925

JFrog artifactory: server-side request forgery

JFrog

CVE-2026-65925 · Published Jul 27, 2026 · updated Jul 30, 2026

Medium6.5
Fix: upgrade to 7.111.18 or later (4 fixed versions below)
JFrog advisory

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

Affected versions

PackageAffectedFixed in
artifactory
Product
< 7.111.187.111.18
>= 7.117.0, < 7.117.257.117.25
>= 7.125.0, < 7.125.187.125.18
>= 7.133.0, < 7.133.277.133.27
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More JFrog advisories

All JFrog
Medium 6.5Jul 27JFrog artifactory: information disclosureCVE-2026-66018fixed in 7.146.34 +1Medium 6.5Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65618fixed in 7.133.6High 8.8Jul 27JFrog artifactory: path traversalCVE-2026-65921fixed in 7.111.18 +3High 7.1Jul 27JFrog artifactory: missing authorizationCVE-2026-65922fixed in 7.111.18 +3Medium 6.8Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65923fixed in 7.111.18 +3Medium 6.5Jul 27JFrog artifactory: server-side request forgeryCVE-2026-65924fixed in 7.111.18 +3