Confluence Data Center (Atlassian) - vulnerabilities (CVEs)

42 CVEs, 1 in the last 30 days, 618 known versions, newest CVE from 2026-10-05. Vendor: Atlassian.

CVEs of Confluence Data Center

CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
CVE-2026-21588 - CVSS 7.1 (high), 2026-09-15: This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and…
CVE-2026-21586 - CVSS 7.1 (high), 2026-09-15: This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1,…
CVE-2026-21580 - CVSS 9.3 (critical), 2026-08-18: This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0,…
CVE-2026-21579 - CVSS 8.2 (high), 2026-07-21: This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and…
CVE-2026-21577 - CVSS 7.1 (high), 2026-07-21: This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of…
CVE-2025-22166 - CVSS 8.3 (high), 2025-10-21: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability,…
CVE-2024-21703 - CVSS 6.4 (medium), 2024-11-27: This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations.…
CVE-2024-21690 - CVSS 8.2 (high), 2024-08-21: This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0,…
CVE-2024-21686 - CVSS 8.7 (high), 2024-07-16: This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS…
CVE-2024-21683 - CVSS 8.8 (high), 2024-05-21: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code…
CVE-2024-21677 - CVSS 8.8 (high), 2024-03-19: This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS…
CVE-2024-21678 - CVSS 8.5 (high), 2024-02-20: This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of…
CVE-2023-22512 - CVSS 7.5 (high), 2024-01-16: This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this…
CVE-2024-21672 - CVSS 8.8 (high), 2024-01-16: This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE)…
CVE-2023-22527 - CVSS 10 (critical), 2024-01-16: A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…
CVE-2024-21674 - CVSS 8.6 (high), 2024-01-16: This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution…
CVE-2024-21673 - CVSS 8.8 (high), 2024-01-16: This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution…
CVE-2023-22526 - CVSS 8.8 (high), 2024-01-16: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution)…
CVE-2023-22522 - CVSS 9 (critical), 2023-12-06: This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence…
CVE-2023-22518 - CVSS 10 (critical), 2023-10-31: All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…
CVE-2023-22515 - CVSS 10 (critical), 2023-10-04: Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in…
CVE-2023-22508 - CVSS 8.8 (high), 2023-07-18: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This…
CVE-2023-22505 - CVSS 8.8 (high), 2023-07-18: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This…
CVE-2023-22504 - CVSS 6.5 (medium), 2023-05-25: Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments…
CVE-2023-22503 - CVSS 5.3 (medium), 2023-05-01: Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private…
CVE-2022-42978 - CVSS 7.5 (high), 2022-11-15: In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the…
CVE-2022-42977 - CVSS 7.5 (high), 2022-11-15: The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During…
CVE-2020-36290 - CVSS 5.4 (medium), 2022-07-26: The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4…
CVE-2022-26137 - CVSS 8.8 (high), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the…
CVE-2022-26136 - CVSS 9.8 (critical), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The…
CVE-2022-26134 - CVSS 9.8 (critical), 2022-06-03: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…
CVE-2021-39114 - CVSS 8.8 (high), 2022-04-05: Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary…
CVE-2021-43940 - CVSS 7.8 (high), 2022-02-15: Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a…
CVE-2021-26084 - CVSS 9.8 (critical), 2021-08-30: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…
CVE-2021-26085 - CVSS 5.3 (medium), 2021-08-03: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability…
CVE-2020-29444 - CVSS 5.4 (medium), 2021-05-07: Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting…
CVE-2021-26072 - CVSS 4.3 (medium), 2021-04-01: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal…
CVE-2020-29448 - CVSS 5.3 (medium), 2021-02-22: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from…
CVE-2020-29450 - CVSS 6.5 (medium), 2021-01-19: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)…
CVE-2020-14175 - CVSS 5.4 (medium), 2020-07-24: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting…
CVE-2020-4027 - CVSS 4.7 (medium), 2020-07-01: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template…
CVE-2019-20406 - CVSS 7.8 (high), 2020-02-06: The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local…
CVE-2018-20239 - CVSS 5.4 (medium), 2019-04-30: Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version…
CVE-2018-20237 - CVSS 6.5 (medium), 2019-02-13: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.