18
CVEs
2
Critical
11
High
0
KEV
3
PoC
6
Unpatched C/H
55.6%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
11
MEDIUM
4
LOW
1
Monthly CVE Trend
Affected Products (30)
Jira Server
88
Jira
83
Jira Data Center
44
Crucible
32
Fisheye
32
Confluence Server
31
Confluence
27
Confluence Data Center
24
Data Center
24
Jira Software Data Center
23
Java
20
Bamboo
20
Mattermost
18
Crowd
11
Bitbucket
11
Jira Service Desk
10
Jira Service Management
9
Sourcetree
8
Open Redirect
7
Xwiki
6
Mcp Atlassian
5
Agiloft
4
In App Desktop Notifications
4
Mattermost Server
4
S Notify
4
Jira Pipeline Steps
4
Pro Macros
4
Secure Login
3
Companion
3
Hipchat
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73498 | Arbitrary file read via path traversal in mcp-atlassian prior to 0.22.0 allows any authenticated MCP client to supply an absolute or traversal path to the confluence_upload_attachment tool, causing the server to open and exfiltrate the targeted file as a Confluence attachment. On Linux deployments, /proc/self/environ exposes live API credentials including CONFLUENCE_API_TOKEN, AWS keys, and database passwords, enabling full Atlassian account takeover and lateral movement. A confirmed prompt injection attack chain means threat actors who can write content an AI agent will read - such as a malicious Jira ticket - can trigger the same credential exfiltration with zero MCP credentials; publicly available exploit code and a demonstration video exist. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-69257 | SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis. | HIGH | 7.6 | 0.2% | 58 |
PoC
|
| CVE-2026-54660 | Credential exfiltration in swagger-typescript-api (npm, versions <= 13.12.1) allows a malicious OpenAPI spec to steal a developer's bearer token during code generation: when `--authorizationToken` is set, the generator attaches that token to the Authorization header of every request it makes while resolving external `$ref` URLs, with no same-origin check, so a `$ref` pointing at an attacker-controlled host receives the token verbatim. The stolen credential is typically high-value (GitHub PAT, OAuth bearer, CI service-account token) and its capture is equivalent to full account/scope takeover. A working proof-of-concept was supplied by the reporter (publicly available exploit code exists); it is not listed in CISA KEV and there is no evidence of active exploitation. | HIGH | 7.4 | 0.2% | 57 |
PoC
|
| CVE-2026-44179 | Remote code execution in XWiki Pro Macros (com.xwiki.pro:xwiki-pro-macros) versions >=1.13 and <1.14.5 allows any authenticated user with page-edit rights to execute arbitrary Groovy code via the excerpt-include macro, which fails to escape the included page's title and renders excerpt content with the macro's elevated rights. A working proof-of-concept is published in the GHSA advisory demonstrating injection through both a crafted page title and excerpt body. No public exploit identified at time of analysis as actively used, but the publicly available exploit code exists in the advisory itself. | CRITICAL | 9.9 | – | 50 |
|
| CVE-2026-21580 | Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program. | CRITICAL | 9.3 | 0.4% | 47 |
No patch
|
| CVE-2026-21582 | Broken authentication in Atlassian Crowd Data Center 7.2.1 permits a remote, unauthenticated attacker to perform actions on behalf of any other user, effectively bypassing the platform's identity and session controls. The flaw was introduced specifically in version 7.2.1, discovered through Atlassian's Penetration Testing program, and carries a CVSS 4.0 score of 8.8 with scope-changing impact that cascades to all downstream SSO-federated applications. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, though the cross-system propagation potential demands urgent patching. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-21579 | Information disclosure in Atlassian Confluence Data Center allows an unauthenticated remote attacker to read sensitive information from affected instances, carrying a CVSS 4.0 score of 8.2 (High). The flaw was introduced across a wide span of releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0) and was found internally by Atlassian. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes patching a priority for internet-facing deployments. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-34151 | Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial. | HIGH | 8.2 | 0.5% | 41 |
|
| CVE-2026-21575 | Remote code execution in Atlassian Sourcetree for Mac and Windows 3.4.11-3.4.12 enables an authenticated attacker to execute arbitrary code on a victim's machine via code injection (CWE-94), achieving full confidentiality, integrity, and availability compromise. The attack requires low-privilege authentication and user interaction - consistent with a scenario where a victim opens or processes attacker-controlled repository content within the application. No public exploit identified at time of analysis; EPSS at 0.30% (22nd percentile) reflects low current exploitation probability, and the vulnerability was responsibly disclosed through Atlassian's Bug Bounty program rather than discovered in active exploitation. | HIGH | 8.0 | 0.3% | 40 |
No patch
|
| CVE-2026-73496 | MCP Atlassian, the Model Context Protocol server that bridges AI clients to Confluence and Jira, resolves client-supplied attachment paths on the server itself, so a remote client with write-tool access can read arbitrary files from the server host in versions before 0.22.0. The confluence_upload_attachment, confluence_upload_attachments and jira_update_issue tools all funnel an unconfined file_path into os.path.abspath() plus open(), and the resulting bytes are uploaded to Atlassian as an attachment — giving the attacker a convenient exfiltration channel for server files, environment-held Atlassian credentials, or other tenants' data. The vendor advisory includes a working proof-of-concept (publicly available exploit code exists), but no active exploitation is confirmed (no CISA KEV listing); the CVSS 3.1 score is 7.7 with EPSS not provided in the input. Only local single-user stdio deployments are outside the trust boundary. | HIGH | 7.7 | 0.3% | 38 |
|
| CVE-2026-21584 | Improper authorization in Atlassian Bamboo Data Center across six affected release lines (10.0.x through 12.1.x) enables authenticated low-privilege users to bypass access controls and reach restricted resources or functionality, with Atlassian tagging the flaw as carrying arbitrary code execution risk. The vulnerability was discovered through Atlassian's own penetration testing program and affects Data Center deployments only - not Bamboo Cloud. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality and integrity impact ratings (VC:H/VI:H in CVSS 4.0) and the RCE tag make this a credible escalation risk in any environment where untrusted or lightly-privileged users hold Bamboo accounts. | HIGH | 7.6 | 0.4% | 38 |
No patch
|
| CVE-2026-66908 | JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-21577 | Denial of service in Atlassian Confluence Data Center allows an authenticated attacker to render the application unavailable to legitimate users by triggering resource exhaustion that disrupts the host's services. Affected releases span the 9.0.x through 10.2.x branches, with a CVSS 4.0 score of 7.1 (High) driven entirely by availability impact. No public exploit has been identified at time of analysis; the flaw was discovered internally via Atlassian's penetration testing program rather than through in-the-wild activity. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-73497 | Server-side request forgery in the MCP Atlassian MCP server (versions 0.17.0 through 0.21.x) allows remote unauthenticated attackers to force the server to make outbound requests to internal addresses such as the cloud metadata endpoint 169.254.169.254. The flaw is an incomplete-fix TOCTOU: validate_url_for_ssrf resolves and approves the attacker-supplied X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url host once at middleware time, but the actual HTTP client re-resolves the raw hostname at connect time with no IP pinning, so a DNS-rebinding name can pass validation with a public IP and then resolve to a link-local or RFC1918 address. Exploitation is a documented, publicly described proof-of-concept rather than confirmed in-the-wild activity (no CISA KEV listing), and the vendor has released version 0.22.0 as the fix. | MEDIUM | 6.5 | 0.2% | 32 |
|
| CVE-2026-6673 | Missing authentication on the Atlassian Connect install callback in Mattermost allows a remote attacker to inject a rogue sharedSecret into an in-progress Jira integration setup. Affected versions span the 10.11.x, 11.5.x, 11.6.x, and 11.7.x release trains, all of which expose the POST /ac/installed endpoint without validating the caller's identity during the pending-install window. No public exploit has been identified at time of analysis, but a successful injection corrupts the integration's trust handshake, yielding high integrity and availability impact against the Jira connection. The vendor CVSS vector assigns PR:L, which conflicts with the description's 'remote unauthenticated attacker' language - this discrepancy warrants direct verification with Mattermost advisory MMSA-2026-00654. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|