Advisories · Technology

Atlassian Confluence Data Center.

Every CVE that names Atlassian Confluence Data Center among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-21589 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Files accessible to external parties in Atlassian Bamboo Data Center and others
- Atlassian Bamboo Data Center
- Atlassian Bitbucket Data Center
- Information disclosure
Not analysed yet 5 Oct 2026
CVE-2026-21588 CVE record

CVSS 7.1 High

Uncontrolled resource consumption in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-21586 CVE record

CVSS 7.1 High

Improper authorization in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Broken access control
Not analysed yet 15 Sept 2026
CVE-2026-21580 CVE record

CVSS 8.6 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 18 Aug 2026
CVE-2026-21577 CVE record

CVSS 7.1 High

Uncontrolled resource consumption in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Denial of service
Not analysed yet 21 Jul 2026
CVE-2026-21579 CVE record

CVSS 8.2 High

Information disclosure in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2025-22166 CVE record

CVSS 8.3 High

Atlassian Confluence Data Center: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of…
- Atlassian Confluence Data Center
- CWE-405
Not analysed yet 21 Oct 2025
CVE-2023-22512 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Uncontrolled resource consumption in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Denial of service
Not analysed yet 17 Mar 2025
CVE-2024-21703 CVE record

CVSS 6.4 Medium

Incorrect permission assignment in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Broken access control
Not analysed yet 27 Nov 2024
CVE-2024-21690 CVE record

CVSS 7.1 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2024
CVE-2024-21686 CVE record

CVSS 7.3 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2024
CVE-2024-21683 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Code injection in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 21 May 2024
CVE-2024-21677 CVE record

CVSS 8.3 High

Path traversal in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Path traversal
Not analysed yet 19 Mar 2024
CVE-2024-21678 CVE record

CVSS 8.5 High

Cross-site scripting in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-21673 CVE record

CVSS 8.0 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2024-21672 CVE record

CVSS 8.3 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2023-22527 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Other injection
Not analysed yet 16 Jan 2024
CVE-2024-21674 CVE record

CVSS 8.6 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2023-22526 CVE record

CVSS 7.2 High

Code injection in Atlassian Confluence Data Center
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 16 Jan 2024
CVE-2023-22522 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Other injection
Not analysed yet 6 Dec 2023
CVE-2023-22518 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Incorrect authorization in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Broken access control
Not analysed yet 31 Oct 2023
CVE-2023-22515 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Improper input validation in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- CWE-20
Not analysed yet 4 Oct 2023
CVE-2023-22508 CVE record

CVSS 8.5 High

Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 18 Jul 2023
CVE-2023-22505 CVE record

CVSS 8.0 High

Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 18 Jul 2023
CVE-2023-22504 CVE record

CVSS 4.3 Medium

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 25 May 2023
CVE-2023-22503 CVE record

CVSS 5.3 Medium

Information disclosure in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Information disclosure
Not analysed yet 1 May 2023
CVE-2020-36290 CVE record

Atlassian Confluence Server: The Livesearch macro in Confluence Server and Data Center before version 7.4.5…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 26 Jul 2022
CVE-2022-26137 CVE record

CVSS 8.8 High

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.
- Atlassian Bamboo Server
- Atlassian Bamboo Data Center
- CWE-180
Not analysed yet 20 Jul 2022
CVE-2022-26136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.
- Atlassian Bamboo Server
- Atlassian Bamboo Data Center
- CWE-180
Not analysed yet 20 Jul 2022
CVE-2022-26134 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Expression language injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 3 Jun 2022
CVE-2021-39114 CVE record

CVSS 8.8 High

Code injection in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 5 Apr 2022
CVE-2021-43940 CVE record

CVSS 7.8 High

Uncontrolled search path in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- CWE-427
Not analysed yet 15 Feb 2022
CVE-2021-26084 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Expression language injection in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 30 Aug 2021
CVE-2021-26085 CVE record

CVSS 5.3 MediumCritical · KEVKEV · ransomware

Forced browsing in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Broken access control
Not analysed yet 3 Aug 2021
CVE-2021-26072 CVE record

Atlassian Confluence Server: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 1 Apr 2021
CVE-2020-29448 CVE record

Atlassian Confluence Server: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 18 Feb 2021
CVE-2020-4027 CVE record

Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 1 Jul 2020
CVE-2019-20406 CVE record

The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to writ…
- Atlassian Confluence Data Center
Not analysed yet 6 Feb 2020
CVE-2018-20237 CVE record

Atlassian Confluence Server: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 13 Feb 2019