CO
DevOps
Confluence
On CISA KEVExploited in the wildRansomware-linked
71
CVEs
10
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 28Medium 29Low 0
Watch
Add Confluence to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3398 In wildKEV | 8.8 | Apr 18 | Atlassian Confluence Server and Data Center Path Traversal Vulnerability Affected: 2.0.0 before unspecified; before 6.6.13; 6.7.0 before unspecified; before 6.12.4; 6.13.0 before unspecified; before 6.13.4; +4 more |
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: All other versions |
| CVE-2024-21683 | 8.8 | May 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server Affected: 7.19.0 before 7.19.24; 7.20.0 through 7.20.3; 8.0.0 through 8.0.4; 8.1.0 through 8.1.4; 8.2.0 through 8.2.3; 8.3.0 through 8.3.4; +8 more |
| CVE-2024-21677 | 8.8 | Mar 19 | This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center Affected: 6.13.0 before 7.19.20; 7.20.0 before 8.5.7 |
| CVE-2024-21673 | 8.8 | Jan 16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server Affected: 7.19.0 before 7.19.18; 8.5.0 before 8.5.5; 8.7.0 before 8.7.2 |
| CVE-2024-21672 | 8.8 | Jan 16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server Affected: 7.19 before 7.19.18; 8.5.0 before 8.5.5; 8.7.0 through 8.7.2 |
| CVE-2023-22526 | 8.8 | Jan 16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center Affected: 7.19 before 7.19.17; 8.5.0 before 8.5.5; 8.7.0 through 8.7.2 |
| CVE-2023-22522 | 8.8 | Dec 6 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page Affected: 4.0 before 7.19.17; 8.0.0 before 8.4.5; 8.5.0 before 8.5.4 |
| CVE-2023-22508 | 8.8 | Jul 18 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server Affected: 6.1.0 before 7.13.20; 7.14.0 before 7.19.8; 7.20.0 before 8.2.0 |
| CVE-2023-22505 | 8.8 | Jul 18 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server Affected: 8.0.0 before 8.3.2 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: before 7.4.17; 7.5.0 before 7.13.7; 7.14.0 before 7.14.3; 7.15.0 before 7.15.2; 7.16.0 before 7.16.4; 7.17.0 before 7.17.4; +1 more |
| CVE-2021-39114 | 8.8 | Apr 5 | Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run… Affected: before 6.13.23; 6.14.0 before 7.4.11; 7.5.0 before 7.11.6; 7.12.0 before 7.12.5 |
| CVE-2019-3394 | 8.8 | Aug 29 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting Affected: 6.1.0 before 6.6.16; 6.7.0 before 6.13.7 |
| CVE-2024-21686 | 8.7 | Jul 16 | This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server Affected: before 7.19.22; 7.20.0 before 8.5.9 |
| CVE-2024-21678 | 8.5 | Feb 20 | This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center Affected: before 7.19.19; 7.20.0 before 8.5.5; 8.6.0 before 8.7.2 |
| CVE-2024-21690 | 8.2 | Aug 21 | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0,… Affected: 7.19.0 through 7.19.25; 7.20.0 through 7.20.3; 8.0.0 through 8.0.4; 8.1.0 through 8.1.4; 8.2.0 through 8.2.3; 8.3.0 through 8.3.4; +6 more |
| CVE-2021-43940 | 7.8 | Feb 15 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking… Affected: before 7.4.10; 7.5.0 before 7.12.3 |
| CVE-2019-20406 | 7.8 | Feb 6 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who… Affected: before 7.0.5 |
| CVE-2026-21579 | 7.5 | Jul 21 | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data… Affected: 10.2.0 to 10.2.13; 10.1.0 to 10.1.2; 10.0.2 to 10.0.3; 9.2.0 to 9.2.21; 9.1.0 to 9.1.1; 9.0.1 to 9.0.3; +3 more |
| CVE-2025-22166 | 7.5 | Oct 21 | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center Affected: 8.5.0 before 8.5.25; 9.2.0 before 9.2.7; 10.0.0 before 10.0.2 |
| CVE-2023-22512 | 7.5 | Jan 16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server Affected: 5.6 before 7.19.14; 8.0.0 before 8.5.1 |
| CVE-2024-21674 | 7.5 | Jan 16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server Affected: 7.19 before 7.19.18; 8.5.0 before 8.5.5; 8.7.0 through 8.7.2 |
| CVE-2022-42978 | 7.5 | Nov 15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled Affected: before 1.3.5 |
| CVE-2022-42977 | 7.5 | Nov 15 | The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it Affected: before 1.3.5 |
| CVE-2017-7415 | 7.5 | Apr 27 | Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +1 more |
| CVE-2016-6668 | 7.5 | Jan 23 | The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17;… Affected: 5.5.0; 5.9.1; 5.9.2; 5.9.3; 5.9.4; 5.9.5; +11 more |
| CVE-2026-21588 | 7.1 | Sep 15 | This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data… Affected: 10.2.0 to 10.2.15; 10.1.0 to 10.1.2; 10.0.2 to 10.0.3; 9.5.1 to 9.5.4; 9.4.0 to 9.4.1; 9.3.1 to 9.3.2; +3 more |
| CVE-2026-21586 | 7.1 | Sep 15 | This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and… Affected: 10.2.1 to 10.2.15; 10.1.0 to 10.1.2; 10.0.2 to 10.0.3; 9.5.1 to 9.5.4; 9.4.0 to 9.4.1; 9.3.1 to 9.3.2; +5 more |
Showing 28