AT
Product
atlantis
6
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 5Medium 0Low 0
Watch
Add atlantis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116676 New | 8.8 | Oct 27 | Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan Affected: >= 0.4.0, < 0.47.1 |
| CVE-2026-64679 | 8.1 | Aug 21 | Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation Affected: >= 0.19.8, < 0.45.0 |
| CVE-2026-82282 | 8.0 | Aug 28 | Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers Affected: through 0.47.1 |
| CVE-2025-58445 | 7.5 | Sep 6 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks Affected: through 0.35.1 |
| CVE-2022-24912 | 7.5 | Jul 29 | The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a… Affected: before 0.19.7 |
Showing 5