FeltSteam0@FeltSteam
@dr3dn0t @AndrewOrlowski But if you look at some of the CVE's like CVE-2026-65617 or CVE-2026-65921 they have credit type "finder" but their actual discovery-source field set to UNKNOWN
1000036
610 followersView on X
CVE-2026-65921(jfrog / artifactory)
LOWCVSS 8.8 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.
0.0/ 10 priority
Sources & remediation
Vendor / third-party advisories
Weakness type (CWE)
CWE-22
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- artifactory
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
artifactory
Deep dive
Activity timeline1 mentions / 1d
Full discourse1 post
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jfrog | artifactory | - | - | - |