# Atlassian Confluence Server.

Every CVE that names Atlassian Confluence Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Cross-site scripting in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2026-21580.md)
  `CVE-2026-21580` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Uncontrolled resource consumption in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22512.md)
  `CVE-2023-22512` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 17 Mar 2025 · Tags: Denial of service
- [Incorrect permission assignment in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21703.md)
  `CVE-2024-21703` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 27 Nov 2024 · Tags: Broken access control
- [Cross-site scripting in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21690.md)
  `CVE-2024-21690` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 7.1 High · Not analysed yet · Published 21 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21686.md)
  `CVE-2024-21686` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Jul 2024 · Tags: Cross-site scripting (XSS)
- [Code injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21673.md)
  `CVE-2024-21673` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.0 High · Not analysed yet · Published 16 Jan 2024 · Tags: Code injection
- [Code injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21672.md)
  `CVE-2024-21672` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.3 High · Not analysed yet · Published 16 Jan 2024 · Tags: Code injection
- [Injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22527.md)
  `CVE-2023-22527` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 16 Jan 2024 · Tags: Other injection
- [Code injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2024-21674.md)
  `CVE-2024-21674` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Jan 2024 · Tags: Code injection
- [Injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22522.md)
  `CVE-2023-22522` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 6 Dec 2023 · Tags: Other injection
- [Incorrect authorization in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22518.md)
  `CVE-2023-22518` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 31 Oct 2023 · Tags: Broken access control
- [Improper input validation in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22515.md)
  `CVE-2023-22515` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.99 · Not analysed yet · Published 4 Oct 2023 · Tags: CWE-20
- [Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was…](https://agentprime.io/advisories/CVE-2023-22508.md)
  `CVE-2023-22508` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.5 High · Not analysed yet · Published 18 Jul 2023
- [Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was…](https://agentprime.io/advisories/CVE-2023-22505.md)
  `CVE-2023-22505` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 8.0 High · Not analysed yet · Published 18 Jul 2023
- [Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability…](https://agentprime.io/advisories/CVE-2023-22504.md)
  `CVE-2023-22504` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 25 May 2023
- [Information disclosure in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2023-22503.md)
  `CVE-2023-22503` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2023 · Tags: Information disclosure
- [Atlassian Confluence Server: The Livesearch macro in Confluence Server and Data Center before version 7.4.5…](https://agentprime.io/advisories/CVE-2020-36290.md)
  `CVE-2020-36290` · CVE record: Atlassian Confluence Server and 1 more · No CVSS score · Not analysed yet · Published 26 Jul 2022
- [A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.](https://agentprime.io/advisories/CVE-2022-26137.md)
  `CVE-2022-26137` · CVE record: Atlassian Bamboo Server and 4 more · CVSS 8.8 High · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-180
- [A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.](https://agentprime.io/advisories/CVE-2022-26136.md)
  `CVE-2022-26136` · CVE record: Atlassian Bamboo Server and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-180
- [Expression language injection in Atlassian Confluence Data Center and others](https://agentprime.io/advisories/CVE-2022-26134.md)
  `CVE-2022-26134` · CVE record: Atlassian Confluence Data Center and 1 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 3 Jun 2022 · Tags: Code injection
- [Code injection in Atlassian Confluence Server and others](https://agentprime.io/advisories/CVE-2021-39114.md)
  `CVE-2021-39114` · CVE record: Atlassian Confluence Server and 1 more · CVSS 8.8 High · Not analysed yet · Published 5 Apr 2022 · Tags: Code injection
- [Uncontrolled search path in Atlassian Confluence Server and others](https://agentprime.io/advisories/CVE-2021-43940.md)
  `CVE-2021-43940` · CVE record: Atlassian Confluence Server and 1 more · CVSS 7.8 High · Not analysed yet · Published 15 Feb 2022 · Tags: CWE-427
- [Expression language injection in Atlassian Confluence Server and others](https://agentprime.io/advisories/CVE-2021-26084.md)
  `CVE-2021-26084` · CVE record: Atlassian Confluence Server and 1 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 30 Aug 2021 · Tags: Code injection
- [Forced browsing in Atlassian Confluence Server and others](https://agentprime.io/advisories/CVE-2021-26085.md)
  `CVE-2021-26085` · CVE record: Atlassian Confluence Server and 1 more · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 3 Aug 2021 · Tags: Broken access control
- [Server-side request forgery in Atlassian Confluence Server](https://agentprime.io/advisories/CVE-2020-29445.md)
  `CVE-2020-29445` · CVE record: Atlassian Confluence Server · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2021 · Tags: Server-side request forgery (SSRF)
- [Cross-site scripting in Atlassian Confluence Server](https://agentprime.io/advisories/CVE-2020-29444.md)
  `CVE-2020-29444` · CVE record: Atlassian Confluence Server · CVSS 5.4 Medium · Not analysed yet · Published 7 May 2021 · Tags: Cross-site scripting (XSS)
- [Atlassian Confluence Server: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version…](https://agentprime.io/advisories/CVE-2021-26072.md)
  `CVE-2021-26072` · CVE record: Atlassian Confluence Server and 1 more · No CVSS score · EPSS 0.41 · Not analysed yet · Published 1 Apr 2021
- [Atlassian Confluence Server: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data…](https://agentprime.io/advisories/CVE-2020-29448.md)
  `CVE-2020-29448` · CVE record: Atlassian Confluence Server and 1 more · No CVSS score · Not analysed yet · Published 18 Feb 2021
- [Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers…](https://agentprime.io/advisories/CVE-2020-29450.md)
  `CVE-2020-29450` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 19 Jan 2021
- [Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers…](https://agentprime.io/advisories/CVE-2020-14175.md)
  `CVE-2020-14175` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 24 Jul 2020
- [Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers…](https://agentprime.io/advisories/CVE-2020-4027.md)
  `CVE-2020-4027` · CVE record: Atlassian Confluence Server and 1 more · No CVSS score · Not analysed yet · Published 1 Jul 2020
- [Atlassian Confluence Server: The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0…](https://agentprime.io/advisories/CVE-2019-20102.md)
  `CVE-2019-20102` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 22 Apr 2020
- [Atlassian Confluence Server: There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews…](https://agentprime.io/advisories/CVE-2019-15006.md)
  `CVE-2019-15006` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 19 Dec 2019
- [Atlassian Bitbucket Server: The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an…](https://agentprime.io/advisories/CVE-2019-15005.md)
  `CVE-2019-15005` · CVE record: Atlassian Bitbucket Server and 4 more · No CVSS score · Not analysed yet · Published 8 Nov 2019
- [Atlassian Confluence Server: There was a local file disclosure vulnerability in Confluence Server and Confluence Data…](https://agentprime.io/advisories/CVE-2019-3394.md)
  `CVE-2019-3394` · CVE record: Atlassian Confluence Server · No CVSS score · EPSS 0.11 · Not analysed yet · Published 29 Aug 2019
- [Path traversal in Atlassian Confluence Server](https://agentprime.io/advisories/CVE-2019-3396.md)
  `CVE-2019-3396` · CVE record: Atlassian Confluence Server · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 25 Mar 2019 · Tags: Path traversal
- [Atlassian Confluence Server: The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7…](https://agentprime.io/advisories/CVE-2019-3395.md)
  `CVE-2019-3395` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 25 Mar 2019
- [Atlassian Confluence Server: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated…](https://agentprime.io/advisories/CVE-2018-20237.md)
  `CVE-2018-20237` · CVE record: Atlassian Confluence Server and 1 more · No CVSS score · Not analysed yet · Published 13 Feb 2019
- [Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments.](https://agentprime.io/advisories/CVE-2017-9505.md)
  `CVE-2017-9505` · CVE record: Atlassian Confluence Server · No CVSS score · Not analysed yet · Published 15 Jun 2017

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=atlassian-confluence-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/atlassian-confluence-server/>. Everything for agents: <https://agentprime.io/llms.txt>.