Atlassian operates a broadly represented portfolio of collaborative development and project-management platforms widely embedded across enterprise software teams, with a particular prominence in issue tracking and code collaboration. Vulnerabilities affecting the vendor concentrate in its flagship Jira, Crucible, and Fisheye products and recur through application-layer weakness classes including cross-site scripting, cross-site request forgery, code injection, and path traversal—flaws typical of complex web applications handling user input and file operations across multi-tenant environments. A meaningful share of the vendor's disclosures reach serious severity, and public exploit code emerges with moderate frequency for vulnerabilities in this product class. Defenders should prioritize tracking Atlassian's coordinated update cycles and treat internet-facing instances of Jira and related tools as high-value targets for remediation; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Atlassian over time
Of all the CVEs published by Atlassian as a CNA, 98.8% affect products that Atlassian develops as a vendor.
Of all the CVEs published that affect products developed by Atlassian, 85.7% are self-published by Atlassian as a CNA.
Signals from CVEs in this vendor scope (467 CVEs).
467 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-36804HIGH Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21 | Aug 25, 2022 | 8.8 | 99 | YES | YES |
CVE-2022-26134CRITICAL In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu | Jun 3, 2022 | 9.8 | 99 | YES | YES |
CVE-2021-26084CRITICAL In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu | Aug 30, 2021 | 9.8 | 99 | YES | YES |
CVE-2019-3396CRITICAL The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from | Mar 25, 2019 | 9.8 | 99 | YES | YES |
CVE-2023-22527CRITICAL A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using | Jan 16, 2024 | 9.8 | 98 | YES | YES |
CVE-2023-22518CRITICAL All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to re | Oct 31, 2023 | 9.8 | 98 | YES | YES |
CVE-2023-22515CRITICAL Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible C | Oct 4, 2023 | 9.8 | 98 | YES | YES |
CVE-2019-11580CRITICAL Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests | Jun 3, 2019 | 9.8 | 98 | YES | YES |
CVE-2019-3398HIGH Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / | Apr 18, 2019 | 8.8 | 98 | YES | YES |
CVE-2022-26138CRITICAL The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuse | Jul 20, 2022 | 9.8 | 97 | YES | YES |
Signals from CVEs in this vendor scope (467 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Atlassian.
Media articles that mention a CVE ID that affects a product developed by Atlassian — matched by CVE ID, not by vendor name.