Vendor
Atlassian
504 known vulnerabilities in products by Atlassian, 14 of them actively exploited (CISA KEV).
Key figures
504
Vulnerabilities
14
Actively exploited (KEV)
8
Used by ransomware
58
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2022-26134 | Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-26084 | Atlassian Confluence Server: Code Execution In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-3396 | Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-11580 | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability In CISA KEVRansomware | 5.3 | |
| Critical | CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2019-11581 | Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2019-3398 | Atlassian Confluence Server and Data Center Path Traversal Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2021-26086 | Atlassian Jira Server and Data Center Path Traversal Vulnerability In CISA KEV | 5.3 | |
| Medium | CVE-2024-2511 | Unbounded memory growth with session handling in TLSv1.3 | 5.9 | |
| Critical | CVE-2022-43781 | Atlassian Bitbucket Server: Command Injection | 9.8 | |
| Critical | CVE-2022-0540 | Atlassian Jira: Authentication Bypass | 9.8 | |
| Critical | CVE-2022-26133 | Atlassian Bitbucket Data Center: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2023-22524 | Atlassian Companion for Mac: Remote Code Execution | 9.6 | |
| Critical | CVE-2020-36239 | Atlassian Jira: Missing Authorization | 9.8 | |
| Critical | CVE-2023-22523 | Atlassian Assets Discovery Cloud: Remote Code Execution | 9.8 | |
| Critical | CVE-2012-2926 | Atlassian Crowd: Denial of Service | 9.1 | |
| Critical | CVE-2019-13990 | Software Quartz: XML External Entity (XXE) | 9.8 | |
| Critical | CVE-2017-5983 | Atlassian Jira: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2023-22501 | Atlassian Jira Service Management Server: security vulnerability | 9.4 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publicationsecurityweek,
- Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)sans-isc-diary,
- Hackers exploit critical Atlassian flaw after public PoC releasebleepingcomputer,
- Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Detailsthehackernews,
- Atlassian’s critical flaw turns eight enterprise products into one big security problemcsoonline,