Priority CRITICAL 99KEV
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.99664 · Published 2026-10-05 · Fixed in Patch version 10.2.24 and later, Patch version 12.1.12 and later +14 CWE-552
Priority LOW 32
This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00426 · Published 2026-07-21 · Fixed in 10.2.7 to 10.2.14, 9.2.17 to 9.2.22 CWE-400
Priority LOW 36
This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00439 · Published 2026-07-21 · Fixed in 10.2.14, 9.2.22 CWE-200
Priority LOW 37
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00503 · Published 2025-10-21 · Fixed in 10.0.2 to 10.0.3, 9.2.7 to 9.2.9 +1 CWE-405
Priority MEDIUM 55
This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15053 · Published 2025-03-17 · Fixed in < 5.6.0, >= 7.19.13 +3 CWE-400
Priority LOW 30
This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00201 · Published 2024-11-27 · Fixed in 8.8.0 to 8.8.1, 8.7.2 +2 CWE-732
Priority LOW 37
This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data…
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00748 · Published 2024-08-21 · Fixed in 9.0.1 to 9.0.2, 8.5.14 +1 CWE-79
Priority MEDIUM 41
This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.0089 · Published 2024-07-16 · Fixed in 8.9.1 to 8.9.4, 8.5.9 to 8.5.12 +1 CWE-79
Priority HIGH 82
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.88267 · Published 2024-05-21 · Fixed in 8.9.1 to 8.9.2, 8.5.9 to 8.5.10 +1 CWE-94
Priority MEDIUM 42
This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00926 · Published 2024-03-19 · Fixed in < 6.13.0, >= 7.19.20 +2 CWE-22
Priority LOW 37
This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00471 · Published 2024-02-20 · Fixed in < 2.7.0, >= 7.19.18 +3 CWE-79
Priority MEDIUM 43
This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01504 · Published 2024-01-16 · Fixed in < 7.13.0, >= 7.19.18 +2 CWE-94
Priority MEDIUM 43
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01363 · Published 2024-01-16 · Fixed in < 7.19.0, >= 7.19.18 +2 CWE-94
Priority CRITICAL 100KEV
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99984 · Published 2024-01-16 · Fixed in < 8.0.0, >= 8.5.4 +2 CWE-74
Priority MEDIUM 42
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01768 · Published 2024-01-16 · Fixed in < 7.19.0, >= 7.19.18 +2 CWE-94
Priority MEDIUM 43
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01565 · Published 2024-01-16 · Fixed in < 7.13.0, >= 7.19.17 +2 CWE-94
Priority MEDIUM 54
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.12947 · Published 2023-12-06 · Fixed in < 4.0.0, >= 7.19.17 +4 CWE-74
Priority CRITICAL 99KEV
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-31 · Fixed in < 1.0.0, >= 7.19.16 +4 CWE-863
Priority CRITICAL 100KEV
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instanc…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9923 · Published 2023-10-04 · Fixed in < 8.0.0, >= 8.3.3 +2 CWE-20
Priority MEDIUM 42
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02167 · Published 2023-07-18 · Fixed in < 6.1.0, >= 7.19.8 +1
Priority MEDIUM 44
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02057 · Published 2023-07-18 · Fixed in < 8.0.0, >= 8.3.2 +1
Priority LOW 31
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00792 · Published 2023-05-01 · Fixed in < 7.20.2, >= 7.13.5 +2 CWE-200
Priority MEDIUM 41
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00898 · Published 2022-11-15 · No fix listed CWE-863
Priority MEDIUM 41
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0107 · Published 2022-11-15 · No fix listed CWE-22
Priority LOW 26
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00697 · Published 2022-07-26 · Fixed in 7.4.5, 7.6.3 +1 CWE-79
Load more
THREATIST.IORead the docs