By year
05
06
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Atlassian flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External PartiesExploited since Oct 15, 2026 · CVSS 9.3
- CVE-2021-26086 Atlassian Jira Server and Data Center Path TraversalExploited since Nov 12, 2024 · CVSS 5.3
- CVE-2023-22527 Atlassian Confluence Data Center and Server Template InjectionExploited since Jan 24, 2024 · ransomware · CVSS 9.8
- CVE-2023-22518 Atlassian Confluence Data Center and Server Improper AuthorizationExploited since Nov 7, 2023 · ransomware · CVSS 9.8
- CVE-2023-22515 Atlassian Confluence Data Center and Server Broken Access ControlExploited since Oct 5, 2023 · ransomware · CVSS 9.8
- CVE-2022-36804 Atlassian Bitbucket Server and Data Center Command InjectionExploited since Sep 30, 2022 · CVSS 8.8
- CVE-2022-26138 Atlassian Questions For Confluence App Hard-coded CredentialsExploited since Jul 29, 2022 · CVSS 9.8
- CVE-2022-26134 Atlassian Confluence Server and Data Center Remote Code ExecutionExploited since Jun 2, 2022 · ransomware · CVSS 9.8
- CVE-2021-26085 Atlassian Confluence Server Pre-Authorization Arbitrary File ReadExploited since Mar 28, 2022 · ransomware · CVSS 5.3
- CVE-2019-11581 Atlassian Jira Server and Data Center Server-Side Template InjectionExploited since Mar 7, 2022 · CVSS 9.8
- CVE-2019-3396 Atlassian Confluence Server and Data Center Server-Side Template InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2021-26084 Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2019-11580 Atlassian Crowd and Crowd Data Center Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2019-3398 Atlassian Confluence Server and Data Center Path TraversalExploited since Nov 3, 2021 · CVSS 8.8
Latest high and critical flaws
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External PartiesExploited · Critical 9.3 · Oct 5, 2026
- CVE-2026-21588 This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 High 7.1 · Sep 15, 2026
- CVE-2026-21587 This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center.High 7.1 · Sep 15, 2026
- CVE-2026-21586 This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2High 7.1 · Sep 15, 2026
- CVE-2026-21584 This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.High 7.6 · Aug 18, 2026
- CVE-2026-21582 This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.High 8.8 · Aug 18, 2026
- CVE-2026-21580 This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, Critical 9.3 · Aug 18, 2026
- CVE-2026-21579 This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0High 8.2 · Jul 21, 2026
- CVE-2026-21577 This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of ConflHigh 7.1 · Jul 21, 2026
- CVE-2026-21575 This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.High 8 · Jul 21, 2026
- CVE-2026-21571 This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of BamboCritical 9.4 · Apr 21, 2026
- CVE-2026-21570 This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of BaHigh 8.6 · Mar 17, 2026
- CVE-2026-21569 This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.High 7.9 · Jan 27, 2026
- CVE-2025-22167 This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data High 8.7 · Oct 21, 2025
- CVE-2025-22166 This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.High 8.3 · Oct 21, 2025
- CVE-2025-22157 This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and SerHigh 7.2 · May 20, 2025
- CVE-2024-21697 This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows.High 8.8 · Nov 19, 2024
- CVE-2024-21690 This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.High 8.2 · Aug 21, 2024
- CVE-2024-21689 This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo DHigh 8 · Aug 20, 2024
- CVE-2024-21687 This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server.High 8.1 · Jul 16, 2024
- CVE-2024-21686 This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server.High 8.7 · Jul 16, 2024
- CVE-2024-21683 This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.High 8.8 · May 21, 2024
- CVE-2024-21677 This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center.High 8.8 · Mar 19, 2024
- CVE-2024-21682 This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions).High 7.2 · Feb 20, 2024
- CVE-2024-21678 This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.High 8.5 · Feb 20, 2024
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.