Atlassian - vulnerabilities (CVEs)

479 CVEs in 102 products, 1 in the last 30 days, newest from 2026-10-05.

Products

Jira Server - 144 CVEs
Jira - 142 CVEs
Jira Data Center - 92 CVEs
Crucible - 53 CVEs
Fisheye - 53 CVEs
Confluence Server - 50 CVEs
Confluence Data Center - 42 CVEs
Jira Software Data Center - 39 CVEs
Data Center - 38 CVEs
Bamboo - 28 CVEs
Crowd - 25 CVEs
Bitbucket - 20 CVEs
Confluence - 19 CVEs
Bitbucket Server - 18 CVEs
Jira Service Management - 18 CVEs
Fisheye And Crucible - 16 CVEs
Sourcetree - 16 CVEs
Jira Service Management Data Center - 15 CVEs
Bitbucket Data Center - 14 CVEs
Jira Server And Data Center - 14 CVEs
Jira Align - 13 CVEs
Jira Service Desk - 13 CVEs
Jira Service Management Server - 12 CVEs
Bamboo Data Center - 8 CVEs
Sourcetree For Windows - 8 CVEs
Application Links - 7 CVEs
Crowd Data Center - 7 CVEs
Bamboo Server - 6 CVEs
Atlassian Fisheye And Crucible - 5 CVEs
Hipchat - 5 CVEs
Jira Service Desk Server - 5 CVEs
Jira Software Server - 5 CVEs
Agiloft - 4 CVEs
Crowd Server - 4 CVEs
Floodlight - 4 CVEs
Jira Core Server - 4 CVEs
Jira Service Desk Data Center - 4 CVEs
Sourcetree For Macos - 4 CVEs
Atlassian Application Links - 3 CVEs
Companion - 3 CVEs
Hipchat Server - 3 CVEs
Jira Core - 3 CVEs
Questions For Confluence - 3 CVEs
Universal Plugin Manager - 3 CVEs
Assets Discovery Data Center - 2 CVEs
Atlassian Connect Spring Boot Acsb - 2 CVEs
Atlassian Crucible - 2 CVEs
Companion App - 2 CVEs
Confluence Questions - 2 CVEs
Connect Spring Boot - 2 CVEs
Crowd2 - 2 CVEs
Floodlight Controller - 2 CVEs
Jira Core Data Center - 2 CVEs
Saml Single Sign On - 2 CVEs
Sourcetree For Mac - 2 CVEs
Activity Streams - 1 CVEs
Alfresco Enterprise Content Management - 1 CVEs
Assets Discovery Cloud - 1 CVEs
Assets Discovery Data Server - 1 CVEs
Atlasboard - 1 CVEs
Atlaskiteditor-core - 1 CVEs
Atlassian-gadgets - 1 CVEs
Atlassian-http - 1 CVEs
Atlassian-renderer - 1 CVEs
Atlassian Bamboo - 1 CVEs
Atlassian Connect Express Ace - 1 CVEs
Atlassian Fisheye - 1 CVEs
Atlassian Gadgets - 1 CVEs
Atlassian Jira - 1 CVEs
Atlassian Oauth Plugin - 1 CVEs
Auto-unapprove Plugin For Bitbucket Server - 1 CVEs
Automation For Jira - 1 CVEs
Bitbucket Auto Unapprove Plugin - 1 CVEs
Cloudtoken - 1 CVEs
Companion For Mac - 1 CVEs
Connect Express - 1 CVEs
Crucible Data Center - 1 CVEs
Editor-core - 1 CVEs
Fisheye Data Center - 1 CVEs
Gajira-comment - 1 CVEs
Gajira-create - 1 CVEs
Greenhopper - 1 CVEs
Hipchat Data Center - 1 CVEs
Hipchat For Mac Desktop Client - 1 CVEs
Html Include And Replace Macro - 1 CVEs
Http Library - 1 CVEs
Jira Comment - 1 CVEs
Jira Create - 1 CVEs
Jira Integration For Hipchat - 1 CVEs
Jira Server For Slack - 1 CVEs
Jira Service Desk Server And Data Center - 1 CVEs
Jira Software - 1 CVEs
Navigator Links - 1 CVEs
Oauth - 1 CVEs
Sourcetree Windows - 1 CVEs
Subversion Application Lifecycle Management - 1 CVEs
Troubleshooting And Support - 1 CVEs
Bitbucket Auto Unapprove - 0 CVEs
Crucible Server - 0 CVEs
Fisheye Server - 0 CVEs
Jira-integration-spi - 0 CVEs
Jira Service Management Server And Data Center - 0 CVEs

Newest CVEs of Atlassian

CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
CVE-2026-21588 - CVSS 7.1 (high), 2026-09-15: This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and…
CVE-2026-21587 - CVSS 7.1 (high), 2026-09-15: This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization…
CVE-2026-21586 - CVSS 7.1 (high), 2026-09-15: This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1,…
CVE-2026-21584 - CVSS 8.1 (high), 2026-08-18: This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.…
CVE-2026-21582 - CVSS 8.8 (high), 2026-08-18: This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data…
CVE-2026-21580 - CVSS 9.3 (critical), 2026-08-18: This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0,…
CVE-2026-21579 - CVSS 8.2 (high), 2026-07-21: This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and…
CVE-2026-21575 - CVSS 8 (high), 2026-07-21: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE…
CVE-2026-21577 - CVSS 7.1 (high), 2026-07-21: This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of…
CVE-2026-21571 - CVSS 9.4 (critical), 2026-04-21: This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of…
CVE-2026-21570 - CVSS 8.8 (high), 2026-03-17: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of…
CVE-2026-21569 - CVSS 7.9 (high), 2026-01-28: This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External…
CVE-2025-22176 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22178 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22177 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22173 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22169 - CVSS 5.4 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22172 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22175 - CVSS 5.4 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22168 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22171 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
CVE-2025-22174 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive…
CVE-2025-22170 - CVSS 5.3 (medium), 2025-10-22: Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a…
CVE-2025-22167 - CVSS 8.7 (high), 2025-10-22: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software…
CVE-2025-22166 - CVSS 8.3 (high), 2025-10-21: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability,…
CVE-2025-35112 - CVSS 5.1 (medium), 2025-08-26: Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the…
CVE-2025-35115 - CVSS 9.2 (critical), 2025-08-26: Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify…
CVE-2025-35114 - CVSS 8.7 (high), 2025-08-26: Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one…
CVE-2025-35113 - CVSS 7.2 (high), 2025-08-26: Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code…