Atlassian
Vulnerability activity for Atlassian: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 7.5HighOct 5, 2026Atlassian Multiple Products Path traversal / file handlingCVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerateAdded to KEV Oct 15, 2026 · 9 days after publicationExploited13% likelyExploit codeNucleiDetection
- 5.3MediumAug 16, 2021Atlassian Jira Server and Data Center Path traversal / file handlingCVE-2021-26086Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.Added to KEV Nov 12, 2024 · 1,184 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
- 10.0CriticalJan 16, 2024Atlassian Confluence Data Center and Server Code / command injectionCVE-2023-22527Atlassian Confluence Data Center and Server. An attacker gains arbitrary code execution and template injection capabilities. Update to the latest version of Confluence and ensure template permissions are set correctly.Added to KEV Jan 24, 2024 · 8 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalOct 31, 2023Atlassian Confluence Data Center and Server Auth bypass / access controlCVE-2023-22518Confluence Data Center and Server applications are affected. An attacker gains unauthorized access to sensitive information and potentially executes arbitrary code. Update to the latest version of Confluence Data Center and Server, and ensure users have the latest security patches.Added to KEV Nov 7, 2023 · 6 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalOct 4, 2023Atlassian Confluence Data Center and Server Auth bypass / access controlCVE-2023-22515(1) Atlassian Confluence Data Center and Server are affected. (2) An attacker gains unauthenticated access to sensitive data and functionality. (3) Update to the latest version of Confluence (at least 7.21.0 or 6.17.14) or apply the corresponding security patch.Added to KEV Oct 5, 2023 · same day as publicationExploited99% likelyExploit codeMetasploit · NucleiDetection
- 8.8HighAug 25, 2022Atlassian Bitbucket Server and Data Center Code / command injectionCVE-2022-36804Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.Added to KEV Sep 30, 2022 · 36 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalJul 20, 2022Atlassian Confluence Auth bypass / access controlCVE-2022-26138Atlassian Questions For Confluence App. An attacker gains administrative access to the Confluence instance. Remove the affected app and ensure no other vulnerable apps are installed.Added to KEV Jul 29, 2022 · 8 days after publicationExploited98% likelyExploit codeNucleiDetection
- 9.8CriticalJun 3, 2022Atlassian Confluence Server/Data Center Code / command injectionCVE-2022-26134Atlassian Confluence Server and Data Center are affected. An attacker gains remote code execution and potentially access to sensitive data. Update to the latest version of Atlassian Confluence Server and Data Center as soon as possible.Added to KEV Jun 2, 2022 · same day as publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 5.3MediumAug 3, 2021Atlassian Confluence Server Auth bypass / access controlCVE-2021-26085Atlassian Confluence Server is affected. An attacker gains arbitrary file read access. Update Confluence Server to the latest version and apply recommended security patches.Added to KEV Mar 28, 2022 · 237 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
- 9.8CriticalAug 9, 2019Atlassian Jira Server and Data Center Code / command injectionCVE-2019-11581Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.Added to KEV Mar 7, 2022 · 940 days after publicationExploited85% likelyExploit codeNucleiDetection
- 9.8CriticalMar 25, 2019Atlassian Confluence Server and Data Server Path traversal / file handlingCVE-2019-3396Confluence Server and Data Center are affected. An attacker gains remote code execution and access to sensitive information. Update to the latest version of Confluence Server and Data Center.Added to KEV Nov 3, 2021 · 953 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalJun 3, 2019Atlassian Crowd and Crowd Data Center Code / command injectionCVE-2019-11580Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.Added to KEV Nov 3, 2021 · 883 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalAug 30, 2021Atlassian Confluence Server and Data Center Code / command injectionCVE-2021-26084Atlassian Confluence Server and Data Center. An attacker gains remote code execution and server access. Update to the latest version of Confluence Server and Data Center.Added to KEV Nov 3, 2021 · 65 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 8.8HighApr 18, 2019Atlassian Confluence Server and Data Center Path traversal / file handlingCVE-2019-3398Atlassian Confluence Server and Data Center. An attacker gains the ability to read and write arbitrary files on the server. Patch to the latest version of Confluence Server and Data Center.Added to KEV Nov 3, 2021 · 929 days after publicationExploited97% likelyExploit codeExploit-DB · NucleiDetection
Recent
- –UnscoredOct 22, 2026AtlassianADV-cccs-80fcf9dae6feSerial number: AV26-1076 Date: October 22, 2026 As of October 20, 2026, Atlassian is affected by vulnerabilities in the following products: Bamboo Data Center and Server Version 12.1.12 and prior Version 10.2.24 and prior Bitbucket Data Center and Server Version 10.2.8 and prior Version 10.5.1 and prior Version 9.4.26 and prior Confluence Data Center and Server Version 11.0.0 and prior Version 10.2.19 and prior Version 9.2.26 and prior Crowd Data Center and Server Version 7.2.4 and prior Fisheye
- 7.5HighOct 5, 2026Atlassian Multiple Products Path traversal / file handlingCVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerateExploited13% likelyExploit codeNucleiDetection
- 8.8HighAug 18, 2026Atlassian Crowd Data Center Auth bypass / access controlCVE-2026-21582This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user. Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported
- 7.5HighJul 21, 2026Atlassian confluence data center Information disclosureCVE-2026-21579This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your
- 6.5MediumJul 21, 2026Atlassian confluence data center Denial of serviceCVE-2026-21577This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade
- 8.0HighJul 21, 2026Atlassian sourcetree Code / command injectionCVE-2026-21575This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgra
- 9.4CriticalApr 21, 2026Atlassian Bamboo Data Center Code / command injectionCVE-2026-21571This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR1.3% likely
- 8.6HighMar 17, 2026Atlassian Bamboo Data Center Code / command injectionCVE-2026-21570This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute m
- 7.9HighJan 28, 2026Atlassian Crowd Data CenterCVE-2026-21569This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to la
- 8.7HighOct 22, 2025Atlassian Jira Software Data Center Path traversal / file handlingCVE-2025-22167This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesyste
- 8.3HighOct 21, 2025Atlassian Confluence Data Center Denial of serviceCVE-2025-22166This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely di
- 9.1CriticalAug 20, 2025AtlassianCVE-2025-9287Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
- 7.2HighMay 20, 2025Atlassian Jira Core Data Center Auth bypass / access controlCVE-2025-22157This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability
- 7.8HighMar 18, 2025Atlassian Sourcetree for Mac Code / command injectionCVE-2023-22514This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.8, and a CVSS Vector of: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H which all
- 7.5HighMar 17, 2025Atlassian Confluence Data Center Denial of serviceCVE-2023-22512Affected: Confluence Data Center and Server version 5.6.0 and above. Attacker gain: Ability to cause a resource to be unavailable for its intended users, resulting in Denial of Service. Recommended action: Update Confluence to the latest version, patch 7.4.16 or later, to resolve this vulnerability.15% likely
- 7.5HighFeb 5, 2025Atlassian Denial of serviceCVE-2024-57699A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for
- 8.8HighNov 19, 2024Atlassian Sourcetree for Mac Code / command injectionCVE-2024-21697This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to execute arbitrary code which h
- 5.3MediumAug 16, 2021Atlassian Jira Server and Data Center Path traversal / file handlingCVE-2021-26086Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.Exploited100% likelyExploit codeExploit-DB · NucleiDetection
- 7.1HighAug 21, 2024Atlassian Confluence Data Center XSSCVE-2024-21690This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery)
- 7.6HighAug 20, 2024Atlassian Bamboo Data Center Code / command injectionCVE-2024-21689This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to exec2.7% likely
- 8.1HighJul 16, 2024Atlassian Bamboo Data Center Path traversal / file handlingCVE-2024-21687This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the content
- 7.4HighJun 18, 2024Atlassian Jira Core Data Center Information disclosureCVE-2024-21685This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclo
- 7.2HighMay 21, 2024Atlassian Confluence Data Center Code / command injectionCVE-2024-21683Affected: Confluence Data Center and Server versions 5.2 and above. Attacker gains: Ability to execute arbitrary code remotely. Recommended action: Upgrade to Confluence Data Center and Server version 7.13.23 or later.88% likelyMetasploit · NucleiDetection
- 8.3HighMar 19, 2024Atlassian Confluence Data Center Path traversal / file handlingCVE-2024-21677This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to
- 8.2HighMar 18, 2024Atlassian Auth bypass / access controlCVE-2024-22257In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null A
- 8.5HighFeb 20, 2024Atlassian Confluence Data Center XSSCVE-2024-21678This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiali
- 7.2HighFeb 20, 2024Atlassian Assets Discovery Data Center Code / command injectionCVE-2024-21682This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Ser
- 10.0CriticalJan 16, 2024Atlassian Confluence Data Center and Server Code / command injectionCVE-2023-22527Atlassian Confluence Data Center and Server. An attacker gains arbitrary code execution and template injection capabilities. Update to the latest version of Confluence and ensure template permissions are set correctly.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 8.0HighJan 16, 2024Atlassian Confluence Data Center Code / command injectionCVE-2024-21673This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker1.5% likely
- 8.3HighJan 16, 2024Atlassian Confluence Data Center Code / command injectionCVE-2024-21672This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker1.4% likely
- 8.6HighJan 16, 2024Atlassian Confluence Data Center Code / command injectionCVE-2024-21674This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacke1.8% likely
- 7.2HighJan 16, 2024Atlassian Confluence Data Center Code / command injectionCVE-2023-22526This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, h1.6% likely
- 9.0CriticalDec 6, 2023Atlassian Confluence Data Center Code / command injectionCVE-2023-22522Affected: Publicly accessible Confluence Data Center and Server instances. Attacker gain: Remote Code Execution (RCE) on the affected instance. Recommended action: Immediately update to the latest version of Confluence Data Center and Server.13% likelyDetection
- 9.8CriticalDec 6, 2023Atlassian Assets Discovery Cloud Code / command injectionCVE-2023-22523This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.11% likely
- 9.6CriticalDec 6, 2023Atlassian Companion for Mac Code / command injectionCVE-2023-22524Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.25% likely
- 8.0HighNov 21, 2023Atlassian Crowd Data Center Code / command injectionCVE-2023-22521This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiali1.2% likely
- 10.0CriticalOct 31, 2023Atlassian Confluence Data Center and Server Auth bypass / access controlCVE-2023-22518Confluence Data Center and Server applications are affected. An attacker gains unauthorized access to sensitive information and potentially executes arbitrary code. Update to the latest version of Confluence Data Center and Server, and ensure users have the latest security patches.Exploited100% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalOct 4, 2023Atlassian Confluence Data Center and Server Auth bypass / access controlCVE-2023-22515(1) Atlassian Confluence Data Center and Server are affected. (2) An attacker gains unauthenticated access to sensitive data and functionality. (3) Update to the latest version of Confluence (at least 7.21.0 or 6.17.14) or apply the corresponding security patch.Exploited99% likelyExploit codeMetasploit · NucleiDetection
- 8.5HighSep 19, 2023Atlassian Bitbucket Data Center Code / command injectionCVE-2023-22513This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidential15% likely
- 7.5HighJul 18, 2023Atlassian Bamboo Data Center Code / command injectionCVE-2023-22506This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions 2.1% likely
- 8.5HighJul 18, 2023Atlassian Confluence Data Center Code / command injectionCVE-2023-22508This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high2.2% likely
- 8.0HighJul 18, 2023Atlassian Confluence Data Center Code / command injectionCVE-2023-22505This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high 2.1% likely
- 5.3MediumJun 21, 2023Atlassian Denial of serviceCVE-2022-25883Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. 2.8% likely
- 8.8HighAug 25, 2022Atlassian Bitbucket Server and Data Center Code / command injectionCVE-2022-36804Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalJul 20, 2022Atlassian Confluence Auth bypass / access controlCVE-2022-26138Atlassian Questions For Confluence App. An attacker gains administrative access to the Confluence instance. Remove the affected app and ensure no other vulnerable apps are installed.Exploited98% likelyExploit codeNucleiDetection
- 9.8CriticalJun 3, 2022Atlassian Confluence Server/Data Center Code / command injectionCVE-2022-26134Atlassian Confluence Server and Data Center are affected. An attacker gains remote code execution and potentially access to sensitive data. Update to the latest version of Atlassian Confluence Server and Data Center as soon as possible.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 7.7HighMay 1, 2022Atlassian DeserializationCVE-2022-25647The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.12% likely
- 5.3MediumAug 3, 2021Atlassian Confluence Server Auth bypass / access controlCVE-2021-26085Atlassian Confluence Server is affected. An attacker gains arbitrary file read access. Update Confluence Server to the latest version and apply recommended security patches.Exploited100% likelyExploit codeExploit-DB · NucleiDetection
- 9.8CriticalAug 9, 2019Atlassian Jira Server and Data Center Code / command injectionCVE-2019-11581Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.Exploited85% likelyExploit codeNucleiDetection
- 8.8HighApr 18, 2019Atlassian Confluence Server and Data Center Path traversal / file handlingCVE-2019-3398Atlassian Confluence Server and Data Center. An attacker gains the ability to read and write arbitrary files on the server. Patch to the latest version of Confluence Server and Data Center.Exploited97% likelyExploit codeExploit-DB · NucleiDetection
Top products
- Crowd Data Center2 CVEs in the last year
- confluence data center2 CVEs in the last year
- Bamboo Data Center2 CVEs in the last year, 1 critical
- sourcetree1 CVE in the last year
- Multiple Products1 CVE in the last year, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 22, 2026Atlassian security advisory (AV26-1076)ADV-cccs-80fcf9dae6fe
- Atlassian · Oct 20, 2026Atlassian Security Bulletin October 20, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- CCCS (Canada) · Oct 15, 2026Atlassian security advisory (AV26-1002) - Update 2CVE-2026-21589
- Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21582
- Atlassian · Aug 18, 2026Atlassian Security Bulletin August 18, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · Jul 21, 2026Atlassian Security Bulletin July 21, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · Jun 16, 2026Atlassian Security Bulletin June 16, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · May 19, 2026Atlassian Security Bulletin May 19, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · Apr 21, 2026Atlassian Security Bulletin April 21, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21571
- Atlassian · Mar 17, 2026Atlassian Security Bulletin March 17, 2026CVE-2022-25883CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527
- Atlassian · Feb 17, 2026Atlassian Security Bulletin February 17, 2026CVE-2022-25883CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527
- Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21569
- Atlassian · Dec 11, 2025Atlassian Security Bulletin December 11, 2025CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · Nov 18, 2025Atlassian Security Bulletin November 18, 2025CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2026-21589
- Atlassian · Oct 21, 2025Atlassian Security Bulletin October 21, 2025CVE-2023-22518CVE-2023-22522CVE-2023-22523CVE-2023-22524CVE-2023-22527CVE-2025-22166
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.