CVE-2026-82329 in JFrog Artifactory could grant an unauthenticated attacker administrator privileges under the default configuration. Fixes are now available for self-managed deployments.
On August 27, 2026, CISA added CVE-2026-66384 in JFrog Artifactory to the KEV catalog. Operators of self-hosted instances should verify their version and deploy available patches.
New technical reports add to the picture of the July breach of Hugging Face’s production infrastructure. According to OpenAI and an assessment by METR, isolated agent runs coordinated through an unauthorized communication channel.
