CVE-2026-66375

Low-privilege users may remove protected Artifactory metadata

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66376

Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66377

Anonymous users may access restricted Artifactory repository information

An unauthenticated user may access restricted repository information under specific conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66378

Authenticated users may access private NuGet metadata

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66380

Authenticated users may access private OCI referrer metadata

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66381

Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-66382

Authenticated users may write files outside the intended Artifactory work directory

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68752

Project Resource Managers may escalate privileges in JFrog Artifactory

A Project Resource Manager may gain broader administrative privileges under specific conditions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68753

Anonymous users may access restricted Artifactory content under specific configurations

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68754

Publishers without delete permission can overwrite docker layer information

A repository publisher without delete permission may modify protected package content under specific conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68755

Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68756

Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68757

Potential improper SAML signature verification in JFrog Artifactory

A user with access to a valid SAML response may impersonate another user under specific conditions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68760

Potential remember-me authentication bypass in JFrog Artifactory

An unauthenticated user may bypass authentication under specific cache conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68758

Authenticated users may access restricted Artifactory support information

A low-privileged authenticated user may access restricted support information under specific conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68759

Integration credential holders may impersonate users in JFrog Access

A holder of a valid integration credential may impersonate other users under specific conditions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-76221

GitPython before 3.1.58 Config Injection via option-name

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-76222

GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-78675

GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-84840

tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tsi-coop

Products

Tsi-dpdp-cms