Jira Service Management (Atlassian) - vulnerabilities (CVEs)
18 CVEs, 1 in the last 30 days, 318 known versions, newest CVE from 2026-10-05. Vendor: Atlassian.
CVEs of Jira Service Management
- CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
- CVE-2025-22157 - CVSS 8.8 (high), 2025-05-20: This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and…
- CVE-2024-21683 - CVSS 8.8 (high), 2024-05-21: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code…
- CVE-2023-22501 - CVSS 9.4 (critical), 2023-02-01: An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain…
- CVE-2022-36800 - CVSS 4.3 (medium), 2022-08-03: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via…
- CVE-2021-43959 - CVSS 5.7 (medium), 2022-07-26: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network…
- CVE-2022-26137 - CVSS 8.8 (high), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the…
- CVE-2022-26136 - CVSS 9.8 (critical), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The…
- CVE-2022-26135 - CVSS 6.5 (medium), 2022-06-30: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to…
- CVE-2022-0540 - CVSS 9.8 (critical), 2022-04-20: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects…
- CVE-2021-43943 - CVSS 4.8 (medium), 2022-02-24: Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or…
- CVE-2021-43948 - CVSS 4.3 (medium), 2022-02-15: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an…
- CVE-2021-43950 - CVSS 4.3 (medium), 2022-02-15: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration…
- CVE-2021-43951 - CVSS 4.3 (medium), 2022-01-10: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details…
- CVE-2021-43949 - CVSS 4.3 (medium), 2022-01-10: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access…
- CVE-2021-39115 - CVSS 7.2 (high), 2021-09-01: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary…
- CVE-2020-36239 - CVSS 9.8 (critical), 2021-07-29: Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and…
- CVE-2019-13990 - CVSS 9.8 (critical), 2019-07-26: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
