Atlassian Confluence vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
61 matching records
- High7.5Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoCheck if you run itEPSS 0.37%Aug 11, 2025
- Low3.7Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription detCheck if you run itEPSS 0.27%Aug 11, 2025
- Medium6.4Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the uCheck if you run itEPSS 0.20%Aug 11, 2025
- High7.2Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription withoutCheck if you run itEPSS 0.22%Aug 11, 2025
- Medium4.0Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access toCheck if you run itEPSS 0.23%Aug 11, 2025
- UnknownConfluence Data Center and Server Remote Code ExecutionPatch nowKEVEPSS 88.27%May 23, 2024
- Critical9.8Atlassian Confluence Data Center and Server Template Injection VulnerabilityPatch nowKEVEPSS 99.98%Jan 15, 2024
- Critical9.8Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityPatch nowKEVEPSS 100.00%Oct 31, 2023
- Critical9.8Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityPatch nowKEVEPSS 99.22%Oct 4, 2023
- Critical9.8Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityPatch nowKEVEPSS 98.24%Jul 20, 2022
- Critical9.8Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 6, 2022
- Critical9.8Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityPatch nowKEVEPSS 100.00%Aug 30, 2021
- UnknownAtlassian Confluence and Data Center Widget Connector VulnerabilityPatch nowKEVAug 17, 2021
- Medium5.3Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityPatch nowKEVEPSS 99.94%Aug 2, 2021
- Medium4.3Atlassian Confluence Server and Data Center Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 41.22%Apr 1, 2021
- Medium4.7Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection…Check if you run itEPSS 1.52%Jul 1, 2020
- High7.8The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attac…Check if you run itEPSS 0.48%Feb 6, 2020
- Medium6.5There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center.Check if you run itEPSS 1.91%Dec 19, 2019
- Medium4.3The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a use…Check if you run itEPSS 1.33%Nov 8, 2019
- High8.8There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.Check this weekEPSS 11.02%Aug 29, 2019
- High8.8Atlassian Confluence Server and Data Center Path Traversal VulnerabilityPatch nowKEVEPSS 97.03%Apr 18, 2019
- Critical9.8The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed versi…Check if you run itEPSS 6.71%Mar 25, 2019
- Critical9.8Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityPatch nowKEVEPSS 99.91%Mar 25, 2019
- Medium4.7The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments th…Check if you run itEPSS 1.00%Jul 10, 2018
- Medium6.1Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vu…Check if you run itEPSS 0.81%Feb 2, 2018