Confluence Server at a glance
7 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 1 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
High max 9.8
Atlassian Produkte: Mehrere Schwachstellen ermöglichen Codeausführung
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Programmcode auszuführen.
first Dec 5, 2023
39 results · Feed
-
High 8.6
This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was intr…
-
High 7.5CVE-2023-22512 EPSS 15%
This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and …
-
Medium 6.4
This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center …
-
High 7.1
This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0,…
-
High 7.3
This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This …
-
Critical 10.0
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…
KEV Jan 24, 2024 -
High 8.0
This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Cente…
-
High 8.3
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center …
-
High 8.6
This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center…
-
Critical 9.0CVE-2023-22522 EPSS 13%
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject …
-
Critical 10.0
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authori…
KEV Nov 7, 2023 -
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
High 8.5
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of…
-
High 8.0
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of…
-
Medium 4.3
Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not wr…
-
Medium 5.3
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of …
-
Unscored —
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and fr…
-
High 8.8
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Fi…
-
Critical 9.8
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used…
-
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Jun 2, 2022 -
High 8.8
Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data …
-
High 7.8
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevate…
-
Critical 9.8
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an u…
KEV Nov 3, 2021 -
Medium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…
KEV Mar 28, 2022 -
Medium 4.3
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify …
-
Medium 5.4
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javas…
-
Unscored —
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attacker…
-
Unscored —
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18,…
-
Unscored —
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's ava…
-
Unscored —
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or Jav…
-
Unscored —
Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration pe…
-
Unscored —
The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version…
-
Unscored —
There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and C…
-
Unscored —
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate …
-
Unscored —
There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An …
-
Unscored —
The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), …
-
Critical 9.8
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…
KEV Nov 3, 2021 -
Unscored —
Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted pa…
-
Unscored —
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creati…