Skip to content
OpenAdvisories

Product · Atlassian

Jira

52 known vulnerabilities.

Jira at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Latest advisories

  • High max 9.8
    WID-SEC-2026-4056 75 CVEs rev. 11

    Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira ausnutzen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzule…

    Oracle IBM Red Hat Atlassian RESF Linux Windows
    first Oct 20, 2026
  • High max 9.3
    WID-SEC-2026-3376 64 CVEs rev. 16

    Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery…

    IBM Red Hat Atlassian Linux Windows
    first Sep 15, 2026
  • High max 10.0
    WID-SEC-2026-2923 93 CVEs 3 exploited rev. 15

    Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzufüh…

    Red Hat Dell Atlassian Linux Windows
    first Aug 18, 2026
  • Medium max 8.2
    WID-SEC-2025-1830 4 CVEs rev. 55

    http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.

    Oracle IBM Red Hat Dell HCL Software Linux Windows
    first Aug 13, 2025
  • Medium max 6.9
    WID-SEC-2025-2301 2 CVEs rev. 18

    Red Hat Enterprise Linux: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service auszuführen.

    IBM Red Hat Dell HCL Software Atlassian Linux
    first Oct 14, 2025
All Critical High Medium Low Exploited only Public exploit

52 results · Feed

  • Unscored —
    CVE-2019-15013

    The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3,…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8449 Public exploit Scanner template EPSS 86%

    The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernam…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8450

    Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8451 Public exploit Scanner template EPSS 94%

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the co…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-14995

    The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an att…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-14997

    The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other u…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-14998

    The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remo…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-14996

    The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows r…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11587

    Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11589

    The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from v…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11588

    The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11584

    The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or Jav…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11586

    The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from versio…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11585

    The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8444

    The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote att…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8445

    Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote …

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8446 Scanner template EPSS 18%

    The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames vi…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8447

    The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export fil…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8448

    The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attacke…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20826

    The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20827

    The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11583

    The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via d…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8442 Scanner template EPSS 60%

    The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3402 Scanner template

    The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8443

    The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3403 Public exploit Scanner template EPSS 54%

    The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and f…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3401 Scanner template EPSS 14%

    The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20824 Scanner template EPSS 38%

    The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScr…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3400

    The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3399

    The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remo…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13404

    The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13403

    The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20232

    The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows re…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13400

    Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from …

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13401

    The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from vers…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13402

    Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 befo…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13391

    The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from …

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13395

    Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 b…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2017-18104

    The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remot…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-5232

    The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows …

    Atlassian Jira Web / CMS