reefs@jfrog.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS reefs@jfrog.com
03
assessed vulnerabilities (150)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-92892US | — | — | ||
Potential arbitrary code execution under specific configurations.
Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or… | ||||
| CVE-2026-105192US | —OT elevated | Exploit | ||
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket… | ||||
| CVE-2026-96456US | — | — | ||
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth… | ||||
| CVE-2026-96455US | —OT elevated | — | ||
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentic… | ||||
| CVE-2026-96454US | —OT elevated | — | ||
Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native funct… | ||||
| CVE-2026-95627US | — | — | ||
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/wr… | ||||
| CVE-2026-95626US | — | — | ||
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its sc… | ||||
| CVE-2026-95625US | — | — | ||
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version n… | ||||
| CVE-2026-95624US | — | — | ||
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version compar… | ||||
| CVE-2026-95623US | — | — | ||
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP… | ||||
| CVE-2026-90898US | —OT elevated | Exploit | ||
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP h… | ||||
| CVE-2026-90894US | — | — | ||
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. N… | ||||
| CVE-2026-86242US | —OT elevated | — | ||
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled… | ||||
| CVE-2026-82642US | — | — | ||
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <scr… | ||||
| CVE-2026-82635US | — | — | ||
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path t… | ||||
| CVE-2026-82329US | —OT critical | KEV | ||
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileg… | ||||
| CVE-2026-70550US | —OT elevated | — | ||
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories t… | ||||
| CVE-2026-70548US | — | — | ||
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. | ||||
| CVE-2026-70551US | — | — | ||
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. | ||||
| CVE-2026-69104US | —OT elevated | — | ||
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes,… | ||||