CVE-2026-92892

CriticalCVSS 9.0/10Last modified Oct 22, 2026

Description

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-928934.3A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where ca CVE-2026-928944.3A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by I CVE-2026-928994.8Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 t CVE-2026-92907.5The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, an CVE-2026-929038.2Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL s CVE-2026-929044.3A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resol CVE-2026-929055.3ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash CVE-2026-929088.3Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged atta CVE-2026-929099.8Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the c CVE-2026-92917.1Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user CVE-2026-929107.2Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev CVE-2026-929118.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject