CO
DevOps
Confluence
On CISA KEVExploited in the wildRansomware-linked
71
CVEs
10
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 28Medium 29Low 0
Watch
Add Confluence to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-26085 RansomwareIn wildKEV | 5.3 | Aug 3 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability Affected: before 7.4.10; 7.5.0 before unspecified; before 7.12.3 |
| CVE-2026-21577 | 6.5 | Jul 21 | This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center Affected: 10.2.0 to 10.2.6; 10.1.0 to 10.1.2; 10.0.2 to 10.0.3; 9.5.1 to 9.5.4; 9.4.0 to 9.4.1; 9.3.1 to 9.3.2; +3 more |
| CVE-2023-22504 | 6.5 | May 25 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access… Affected: before 7.13.17; 7.14.0 before 7.19.9; 7.20.0 before 8.2.2 |
| CVE-2020-29450 | 6.5 | Jan 19 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the… Affected: before 7.2.0 |
| CVE-2019-15006 | 6.5 | Dec 19 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center Affected: 6.11.0 before 6.13.10 |
| CVE-2018-20237 | 6.5 | Feb 13 | Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature Affected: before 6.13.1 |
| CVE-2024-21703 | 6.4 | Nov 27 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations Affected: before 7.19.18; 8.0.0 before 8.5.5 |
| CVE-2019-20102 | 6.1 | Apr 22 | The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to… Affected: 6.14.0 through 6.14.3; 6.15.0 before 6.15.5 |
| CVE-2017-18086 | 6.1 | Feb 2 | Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability… Affected: before 6.4.2 |
| CVE-2017-18085 | 6.1 | Feb 2 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: before 6.6.1 |
| CVE-2017-16856 | 6.1 | Dec 5 | The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in… Affected: before 6.5.2 |
| CVE-2016-6283 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to… Affected: through 5.10.5 |
| CVE-2015-8398 | 6.1 | Apr 11 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to… Affected: through 5.8.16 |
| CVE-2020-36290 | 5.4 | Jul 26 | The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote… Affected: before 7.4.5; 7.5.0 before 7.6.3; 7.7.0 before 7.7.4 |
| CVE-2020-29444 | 5.4 | May 7 | Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin… Affected: before 7.11.0 |
| CVE-2020-14175 | 5.4 | Jul 24 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in… Affected: before 7.4.2; 7.5.0 before 7.5.2 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 6.15.2 |
| CVE-2017-18083 | 5.4 | Feb 2 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.4.0 |
| CVE-2016-4317 | 5.4 | Apr 10 | Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page Affected: through 5.9.10 |
| CVE-2023-22503 | 5.3 | May 1 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space Affected: before 7.13.15; 7.14.0 before 7.19.7; 7.20.0 before 8.2.0 |
| CVE-2020-29448 | 5.3 | Feb 22 | The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3… Affected: before 6.13.18; 6.14.0 before 7.4.6; 7.5.0 before 7.8.3 |
| CVE-2017-18084 | 4.8 | Feb 2 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.3.4 |
| CVE-2020-4027 | 4.7 | Jul 1 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations… Affected: before 7.4.5 |
| CVE-2018-13389 | 4.7 | Jul 10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a… Affected: before 6.6.1 |
| CVE-2020-29445 | 4.3 | May 7 | Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request… Affected: before 7.4.8; 7.5.0 before 7.11.0 |
| CVE-2021-26072 | 4.3 | Apr 1 | The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources… Affected: before 5.8.6 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 7.0.1 |
| CVE-2017-9505 | 4.3 | Jun 15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments Affected: 4.3 before 6.2.1 |
| CVE-2015-8399 | 4.3 | Apr 11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2)… Affected: through 5.8.16 |
Showing 29