Atlassian Confluence vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
61 matching records
- Critical9.3CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian productsPatch nowKEVEPSS 99.66%Oct 5, 2026
- High7.6This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 0.46%Aug 18, 2026
- High8.8This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.Check if you run itEPSS 0.46%Aug 18, 2026
- High8.2This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Con…Check if you run itEPSS 0.44%Jul 21, 2026
- High7.1This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.Check if you run itEPSS 0.43%Jul 21, 2026
- Critical9.1Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 5.38%May 12, 2026
- Critical9.4This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 1.34%Apr 21, 2026
- High8.6This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.Check if you run itEPSS 0.61%Mar 17, 2026
- High8.0MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).Check this weekEPSS 11.50%Mar 10, 2026
- High8.2MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).Check this weekEPSS 13.00%Mar 10, 2026
- High7.7Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Confluence users with malicCheck if you run itEPSS 0.22%Feb 6, 2026
- High8.3XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.40%Dec 5, 2025
- Medium6.8XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.30%Nov 19, 2025
- Critical10.0XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.73%Sep 9, 2025
- Critical10.0XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.73%Sep 9, 2025
- Critical10.0XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.79%Sep 9, 2025
- Critical10.0XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 1.05%Sep 9, 2025
- Medium4.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to theCheck if you run itEPSS 0.21%Aug 11, 2025
- High7.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoCheck if you run itEPSS 0.37%Aug 11, 2025
- High7.2Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptiCheck if you run itEPSS 0.26%Aug 11, 2025
- Medium5.9Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an iCheck if you run itEPSS 0.32%Aug 11, 2025
- Medium5.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space theCheck if you run itEPSS 0.23%Aug 11, 2025
- Medium4.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to thCheck if you run itEPSS 0.22%Aug 11, 2025
- Low3.7Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access toCheck if you run itEPSS 0.23%Aug 11, 2025
- Medium5.9Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an iCheck if you run itEPSS 0.31%Aug 11, 2025