AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JFrogCVE-2026-70548

JFrog artifactory: server-side request forgery

JFrog

CVE-2026-70548 · Published Aug 25, 2026 · updated Aug 28, 2026

Low3.5
Fix: upgrade to 7.161.19 or later (2 fixed versions below)
JFrog advisory

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

Affected versions

PackageAffectedFixed in
artifactory
Product
>= 7.161.11, < 7.161.197.161.19
>= 7.146.0, < 7.146.367.146.36
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More JFrog advisories

All JFrog
Critical 9.8Aug 28JFrog artifactory: improper authenticationCVE-2026-82329fixed in 7.111.21 +3Medium 6.5Aug 25JFrog artifactory: missing authorizationCVE-2026-70550fixed in 7.161.19 +1High 8.5Aug 25JFrog artifactory: server-side request forgeryCVE-2026-70551fixed in 7.161.19 +1High 7.6Aug 25JFrog artifactory: information disclosureCVE-2026-69104fixed in 7.161.19High 8.8Aug 12JFrog artifactory: improper input validationCVE-2026-69106fixed in 7.146.28High 7.5Aug 12JFrog artifactory: improper authenticationCVE-2026-42018fixed in 7.111.20 +3