Atlassian
449 CVEs across 117 Atlassian products. Browse Atlassian vulnerabilities, severities, and proof-of-concept exploits.
Atlassian products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21579 | High | 7.5 | 2026-07-21 | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2… |
CVE-2026-21577 | Medium | 6.5 | 2026-07-21 | This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Conf… |
CVE-2026-21575 | High | 8.0 | 2026-07-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (R… |
CVE-2026-21571 | High | 8.8 | 2026-04-21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamb… |
CVE-2026-21570 | High | 8.8 | 2026-03-17 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of B… |
CVE-2026-21569 | High | 7.9 | 2026-01-28 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML Externa… |
CVE-2025-22178 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22177 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22176 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22175 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22174 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22173 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22172 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22171 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users. |
CVE-2025-22170 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular… |
CVE-2025-22169 | Medium | 5.4 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22168 | Medium | 4.3 | 2025-10-22 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information… |
CVE-2025-22167 | Medium | 6.5 | 2025-10-22 | This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data… |
CVE-2025-22166 | High | 7.5 | 2025-10-21 | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability… |
CVE-2025-35115 | High | 8.1 | 2025-08-26 | Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the… |
CVE-2025-35114 | High | 7.5 | 2025-08-26 | Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one… |
CVE-2025-35113 | Medium | 5.9 | 2025-08-26 | Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code exec… |
CVE-2025-35112 | Medium | 4.1 | 2025-08-26 | Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the t… |
CVE-2025-22165 | High | 7.3 | 2025-07-24 | This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) v… |
CVE-2025-22157 | High | 8.8 | 2025-05-20 | This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Se… |
CVE-2019-15002 | Medium | 4.3 | 2025-02-11 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker… |
CVE-2024-21703 | Medium | 6.4 | 2024-11-27 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. … |
CVE-2024-21697 | High | 8.8 | 2024-11-19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. T… |
CVE-2024-21690 | High | 8.2 | 2024-08-21 | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4… |
CVE-2024-21689 | High | 8.0 | 2024-08-20 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo… |
CVE-2024-21684 | Medium | 4.3 | 2024-07-24 | There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0… |
CVE-2024-21687 | High | 8.1 | 2024-07-16 | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server… |
CVE-2024-21686 | High | 8.7 | 2024-07-16 | This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS S… |
CVE-2024-21685 | Medium | 6.5 | 2024-06-18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information D… |
CVE-2024-21683 | High | 8.8 | 2024-05-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Executi… |
CVE-2024-21677 | High | 8.8 | 2024-03-19 | This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Scor… |
CVE-2024-21682 | High | 7.2 | 2024-02-20 | This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlas… |
CVE-2024-21678 | High | 8.5 | 2024-02-20 | This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8… |
CVE-2023-22514 | High | 7.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE… |
CVE-2023-22512 | High | 7.5 | 2024-01-16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this v… |
CVE-2024-21674 | High | 7.5 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE… |
CVE-2024-21673 | High | 8.8 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RC… |
CVE-2024-21672 | High | 8.8 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE)… |
CVE-2023-22527 | Critical | 9.8 | 2024-01-16 | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected inst… |
CVE-2023-22526 | High | 8.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vu… |
CVE-2023-22524 | Critical | 9.8 | 2023-12-06 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypas… |
CVE-2023-22523 | High | 8.8 | 2023-12-06 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. T… |
CVE-2023-22522 | High | 8.8 | 2023-12-06 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page… |
CVE-2023-22521 | High | 8.8 | 2023-11-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Executio… |
CVE-2023-22516 | High | 8.8 | 2023-11-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and… |
CVE-2023-22518 | Critical | 9.8 | 2023-10-31 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthent… |
CVE-2023-22515 | Critical | 9.8 | 2023-10-04 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in… |
CVE-2023-22513 | High | 8.8 | 2023-09-19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Executi… |
CVE-2023-22506 | High | 8.8 | 2023-07-19 | This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. Th… |
CVE-2023-22508 | High | 8.8 | 2023-07-18 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This R… |
CVE-2023-22505 | High | 8.8 | 2023-07-18 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This… |
CVE-2023-22504 | Medium | 6.5 | 2023-05-25 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments v… |
CVE-2023-22503 | Medium | 5.3 | 2023-05-01 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Conf… |
CVE-2023-22501 | Critical | 9.1 | 2023-02-01 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain… |
CVE-2022-43782 | Critical | 9.8 | 2022-11-17 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call pr… |
CVE-2022-43781 | Critical | 9.8 | 2022-11-17 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their userna… |
CVE-2022-42978 | High | 7.5 | 2022-11-15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remot… |
CVE-2022-42977 | High | 7.5 | 2022-11-15 | The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During… |
CVE-2022-36803 | High | 8.8 | 2022-10-14 | The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the Maste… |
CVE-2022-36802 | Medium | 4.9 | 2022-10-14 | The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources… |
CVE-2022-36804 | High | 8.8 | 2022-08-25 | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18… |
CVE-2022-36801 | Medium | 6.1 | 2022-08-10 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site S… |
CVE-2022-36800 | Medium | 4.3 | 2022-08-03 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via a… |
CVE-2022-36799 | High | 7.2 | 2022-08-01 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2021-43959 | Medium | 5.7 | 2022-07-26 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network re… |
CVE-2020-36290 | Medium | 5.4 | 2022-07-26 | The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 al… |
CVE-2022-26138 | Critical | 9.8 | 2022-07-20 | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the usern… |
CVE-2022-26137 | High | 8.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application… |
CVE-2022-26136 | Critical | 9.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impa… |
CVE-2022-26135 | Medium | 6.5 | 2022-06-30 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to p… |
CVE-2022-26134 | Critical | 9.8 | 2022-06-03 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2022-26133 | Critical | 9.8 | 2022-04-20 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later… |
CVE-2022-0540 | Critical | 9.8 | 2022-04-20 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atl… |
CVE-2021-39114 | High | 8.8 | 2022-04-05 | Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Jav… |
CVE-2021-43958 | Critical | 9.8 | 2022-03-16 | Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not ch… |
CVE-2021-43957 | High | 7.5 | 2022-03-16 | Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability… |
CVE-2021-43956 | Medium | 6.1 | 2022-03-16 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a protot… |
CVE-2021-43955 | Medium | 4.3 | 2022-03-16 | The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about inst… |
CVE-2021-43954 | Medium | 4.3 | 2022-03-14 | The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enu… |
CVE-2021-43944 | High | 7.2 | 2022-03-08 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2021-43945 | Medium | 4.8 | 2022-02-28 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScrip… |
CVE-2021-43943 | Medium | 4.8 | 2022-02-24 | Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScr… |
CVE-2021-43948 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an… |
CVE-2021-43941 | Medium | 6.5 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and Importer… |
CVE-2021-43940 | High | 7.8 | 2022-02-15 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a D… |
CVE-2021-43953 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings v… |
CVE-2021-43950 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration informat… |
CVE-2021-43952 | Medium | 4.3 | 2022-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Si… |
CVE-2021-43951 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details… |
CVE-2021-43949 | Medium | 4.3 | 2022-01-10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access… |
CVE-2021-43947 | High | 7.2 | 2022-01-06 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Exe… |
CVE-2021-43946 | Medium | 6.5 | 2022-01-05 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broke… |
CVE-2021-43942 | Medium | 6.1 | 2022-01-04 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (… |
CVE-2021-41311 | High | 7.5 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify pr… |
CVE-2021-41309 | Medium | 5.3 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of anothe… |