Advisories · Technology

Atlassian Confluence Server.

Every CVE that names Atlassian Confluence Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-21580 CVE record

CVSS 8.6 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 18 Aug 2026
CVE-2023-22512 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Uncontrolled resource consumption in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Denial of service
Not analysed yet 17 Mar 2025
CVE-2024-21703 CVE record

CVSS 6.4 Medium

Incorrect permission assignment in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Broken access control
Not analysed yet 27 Nov 2024
CVE-2024-21690 CVE record

CVSS 7.1 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 21 Aug 2024
CVE-2024-21686 CVE record

CVSS 7.3 High

Cross-site scripting in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2024
CVE-2024-21673 CVE record

CVSS 8.0 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2024-21672 CVE record

CVSS 8.3 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2023-22527 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Other injection
Not analysed yet 16 Jan 2024
CVE-2024-21674 CVE record

CVSS 8.6 High

Code injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 16 Jan 2024
CVE-2023-22522 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Other injection
Not analysed yet 6 Dec 2023
CVE-2023-22518 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Incorrect authorization in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Broken access control
Not analysed yet 31 Oct 2023
CVE-2023-22515 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Improper input validation in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- CWE-20
Not analysed yet 4 Oct 2023
CVE-2023-22508 CVE record

CVSS 8.5 High

Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 18 Jul 2023
CVE-2023-22505 CVE record

CVSS 8.0 High

Atlassian Confluence Data Center: This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 18 Jul 2023
CVE-2023-22504 CVE record

CVSS 4.3 Medium

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability…
- Atlassian Confluence Data Center
- Atlassian Confluence Server
Not analysed yet 25 May 2023
CVE-2023-22503 CVE record

CVSS 5.3 Medium

Information disclosure in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Information disclosure
Not analysed yet 1 May 2023
CVE-2020-36290 CVE record

Atlassian Confluence Server: The Livesearch macro in Confluence Server and Data Center before version 7.4.5…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 26 Jul 2022
CVE-2022-26137 CVE record

CVSS 8.8 High

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.
- Atlassian Bamboo Server
- Atlassian Bamboo Data Center
- CWE-180
Not analysed yet 20 Jul 2022
CVE-2022-26136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.
- Atlassian Bamboo Server
- Atlassian Bamboo Data Center
- CWE-180
Not analysed yet 20 Jul 2022
CVE-2022-26134 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Expression language injection in Atlassian Confluence Data Center and others
- Atlassian Confluence Data Center
- Atlassian Confluence Server
- Code injection
Not analysed yet 3 Jun 2022
CVE-2021-39114 CVE record

CVSS 8.8 High

Code injection in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 5 Apr 2022
CVE-2021-43940 CVE record

CVSS 7.8 High

Uncontrolled search path in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- CWE-427
Not analysed yet 15 Feb 2022
CVE-2021-26084 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Expression language injection in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Code injection
Not analysed yet 30 Aug 2021
CVE-2021-26085 CVE record

CVSS 5.3 MediumCritical · KEVKEV · ransomware

Forced browsing in Atlassian Confluence Server and others
- Atlassian Confluence Server
- Atlassian Confluence Data Center
- Broken access control
Not analysed yet 3 Aug 2021
CVE-2020-29445 CVE record

CVSS 4.3 Medium

Server-side request forgery in Atlassian Confluence Server
- Atlassian Confluence Server
- Server-side request forgery (SSRF)
Not analysed yet 7 May 2021
CVE-2020-29444 CVE record

CVSS 5.4 Medium

Cross-site scripting in Atlassian Confluence Server
- Atlassian Confluence Server
- Cross-site scripting (XSS)
Not analysed yet 7 May 2021
CVE-2021-26072 CVE record

Atlassian Confluence Server: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 1 Apr 2021
CVE-2020-29448 CVE record

Atlassian Confluence Server: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 18 Feb 2021
CVE-2020-29450 CVE record

Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers…
- Atlassian Confluence Server
Not analysed yet 19 Jan 2021
CVE-2020-14175 CVE record

Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers…
- Atlassian Confluence Server
Not analysed yet 24 Jul 2020
CVE-2020-4027 CVE record

Atlassian Confluence Server: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 1 Jul 2020
CVE-2019-20102 CVE record

Atlassian Confluence Server: The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0…
- Atlassian Confluence Server
Not analysed yet 22 Apr 2020
CVE-2019-15006 CVE record

Atlassian Confluence Server: There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews…
- Atlassian Confluence Server
Not analysed yet 19 Dec 2019
CVE-2019-15005 CVE record

Atlassian Bitbucket Server: The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an…
- Atlassian Bitbucket Server
- Atlassian Jira Server
Not analysed yet 8 Nov 2019
CVE-2019-3394 CVE record

Atlassian Confluence Server: There was a local file disclosure vulnerability in Confluence Server and Confluence Data…
- Atlassian Confluence Server
Not analysed yet 29 Aug 2019
CVE-2019-3396 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Path traversal in Atlassian Confluence Server
- Atlassian Confluence Server
- Path traversal
Not analysed yet 25 Mar 2019
CVE-2019-3395 CVE record

Atlassian Confluence Server: The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7…
- Atlassian Confluence Server
Not analysed yet 25 Mar 2019
CVE-2018-20237 CVE record

Atlassian Confluence Server: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated…
- Atlassian Confluence Server
- Atlassian Confluence Data Center
Not analysed yet 13 Feb 2019
CVE-2017-9505 CVE record

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments.
- Atlassian Confluence Server
Not analysed yet 15 Jun 2017