CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
[Impact] Unauthenticated remote attackers can access sensitive files within the web application root directory, leading to information disclosure.
[Mitigation] Immediately upgrade to the fixed versions provided by Atlassian and restrict access to sensitive web root files.
Atlassian Confluence Server and Data Center OGNL Template Injection Remote Code Execution (RCE) Vulnerability (CVE-2023-22527) Security Advisory
[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.
[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVE-2023-22518) Security Advisory
[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)
[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.
[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.
Atlassian Confluence Data Center and Server Privilege Escalation and RCE Vulnerability (CVE-2023-22515) Security Advisory
[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)
[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise
[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately
Atlassian Jira Server and Data Center Path Traversal Information Disclosure Vulnerability (CVE-2021-26086) Security Advisory
[Affected Scope] Atlassian Jira Server and Data Center versions before 8.5.14, 8.6.0 before 8.13.6, and 8.14.0 before 8.16.1
[Impact] Unauthenticated remote attackers can exploit a path traversal vulnerability to read sensitive configuration files, such as '/WEB-INF/web.xml'
[Mitigation] Immediately upgrade Jira instances to the patched versions (8.5.14, 8.13.6, 8.16.1, or later) and apply WAF access control rules