BA
Product
Bamboo
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 14Medium 6Low 0
Watch
Add Bamboo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: 7.0.1 before 10.2.24; 11.0.0 before 12.1.12 |
| CVE-2026-21571 | 8.8 | Apr 21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 9.6.2 before 9.6.25; 10.0.0 before 10.2.18; 11.0.0 before 12.1.6 |
| CVE-2026-21570 | 8.8 | Mar 17 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 9.6.1 before 9.6.24; 10.0.0 before 10.2.16; 11.0.0 before 12.1.3 |
| CVE-2023-22516 | 8.8 | Nov 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server Affected: 8.1.0 before 9.2.7; 9.3.0 before 9.3.4 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: 7.2.0 before 7.2.10; 8.0.0 before 8.0.9; 8.1.0 before 8.1.8; 8.2.0 before 8.2.4 |
| CVE-2018-5224 | 8.8 | Mar 29 | Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters Affected: 2.7.0 before 6.3.3; 6.4.0 before 6.4.1 |
| CVE-2017-18080 | 8.8 | Feb 2 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF)… Affected: before 6.3.1 |
| CVE-2017-18042 | 8.8 | Feb 2 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery… Affected: before 6.3.1 |
| CVE-2017-9514 | 8.8 | Oct 12 | Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.1.0; +2 more |
| CVE-2015-6576 | 8.8 | Oct 3 | Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource Affected: 2.2 before 5.8.5; 5.9 before 5.9.7 |
| CVE-2017-8907 | 8.8 | Jun 14 | Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0.1; +34 more |
| CVE-2026-21584 | 8.1 | Aug 18 | This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 10.0.0 before 10.2.22; 11.0.0 before 12.1.10 |
| CVE-2024-21687 | 8.1 | Jul 16 | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server Affected: 9.0.0 through 9.0.4; 9.1.0 through 9.1.3; 9.2.0 before 9.2.16; 9.3.0 through 9.3.6; 9.4.0 through 9.4.3; 9.5.0 through 9.5.4; +1 more |
| CVE-2024-21689 | 8.0 | Aug 20 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and… Affected: 9.1.0 before 9.2.17; 9.3.0 before 9.6.5 |
Showing 14