JFrog software supply chain solutions provide an end-to-end pipeline to control your binaries from build to production. Power your software updates to the edge.
Our summarySoftware supply chain company, maker of the Artifactory repository. JFrog Security Research reports malicious packages and vulnerabilities.
“Automate open-source package vetting and block risky components before they enter your pipeline. Ensure secure, compliant software delivery with JFrog Curation.”
Blocks malicious and risky open-source packages before they enter your repositories.
Product page“Detect, Prioritize and Remediate Open Source Risks Across your SDLC. Empower developers to find and fix security and compliance issues from the start”
Software composition analysis and SBOM generation for artifacts.
Product pageIndependent tests, peer reviews and articles about JFrog. We link to them; we did not write or commission them, and nobody pays to appear here.
Stories in our coverage based on what researchers at JFrog found or reported: 26 in total.
Critical LMCache vulnerability allows unauthenticated remote code execution.
Attackers use malicious Terraform providers and Go modules to distribute Go malware.
Critical Bifrost AI Gateway flaw allows unauthenticated command execution.
Parallels Desktop flaw allows non-admin Mac users to gain root access.
ChainDrop attack infects over 400 NPM packages with malware to steal secrets.
Trojanized NuGet package 'Newtonsoftt.Json.Net' targets Digitain's gaming platform.
148 npm packages disguised as student proxies became a DDoS botnet.
North Korea-linked npm packages mimic Rollup polyfills to steal developer secrets.
Weekly recap covers Linux kernel flaw DirtyClone, PTC Windchill RCE, OpenAI GPT models for security, Gaslight macOS
Linux kernel vulnerability CVE-2026-43503 allows local users to gain root privileges.
Stories where a JFrog product had a vulnerability or was attacked, or JFrog itself was: 25 in total. Useful if you run its products.
Three JFrog Artifactory flaws are being exploited to deploy backdoors and gain admin privileges.
CISA adds 5 actively exploited vulnerabilities in Artifactory, ScreenConnect, and RouterOS to its KEV catalog.
Attackers exploit Artifactory flaws to gain admin access and deploy Rust backdoor.
CISA adds three exploited vulnerabilities to KEV Catalog, impacting JFrog Artifactory and ConnectWise ScreenConnect.
Attackers chained two JFrog Artifactory flaws to gain admin control and plant backdoors.
Sangoma Switchvox vulnerability CVE-2026-9586 is being exploited in the wild.
CISA adds seven exploited vulnerabilities to KEV catalog, enabling reverse shells and crypto miners.
Critical JFrog Artifactory flaw (CVE-2026-82329) allows attackers to forge admin tokens.
Critical Artifactory flaw CVE-2026-82329 allows attackers admin access post-disclosure.
Critical JFrog Artifactory vulnerability CVE-2026-82329 is being exploited in the wild.
Get an email when a reviewed story names JFrog, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
