Atlassian Confluence Data Center
39 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-21589 | All other versions | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba | CRITICAL 9.3 | 99 % | KEV | |
| CVE-2026-21588 | 10.2.0 to 10.2.15 ; 10.1.0 to 10.1.2 ; 10.0.2 to 10.0.3 ; … | This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, | HIGH 7.1 | 0.4 % | ||
| CVE-2026-21586 | 10.2.1 to 10.2.15 ; 10.1.0 to 10.1.2 ; 10.0.2 to 10.0.3 ; … | This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, | HIGH 7.1 | 0.4 % | ||
| CVE-2026-21580 | 10.2.0 to 10.2.11 ; 10.1.0 to 10.1.2 ; 10.0.2 to 10.0.3 ; … | This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7. | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-21579 | 10.2.0 to 10.2.13 ; 10.1.0 to 10.1.2 ; 10.0.2 to 10.0.3 ; … | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2 | HIGH 8.2 | 0.4 % | ||
| CVE-2026-21577 | 10.2.0 to 10.2.6 ; 10.1.0 to 10.1.2 ; 10.0.2 to 10.0.3 ; … | This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 | HIGH 7.1 | 0.4 % | ||
| CVE-2025-22166 | 9.5.1 to 9.5.4 ; 9.4.0 to 9.4.1 ; 9.3.1 to 9.3.2 ; … | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Ser | HIGH 8.3 | 0.5 % | ||
| CVE-2023-22512 | >= 5.6.0 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS S | HIGH 7.5 | 15 % | ||
| CVE-2024-21703 | 8.7.1 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Window | MEDIUM 6.4 | 0.2 % | ||
| CVE-2024-21690 | 8.9.0 to 8.9.5 ; 8.8.0 to 8.8.1 ; 8.7.1 to 8.7.2 ; … | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0 | HIGH 8.2 | 0.7 % | ||
| CVE-2024-21686 | 8.9.0 ; 8.8.0 to 8.8.1 ; 8.7.1 to 8.7.2 ; … | This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerabi | HIGH 8.7 | 0.9 % | ||
| CVE-2024-21683 | 8.9.0 ; 8.8.0 to 8.8.1 ; 8.7.1 to 8.7.2 ; … | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE ( | HIGH 8.8 | 88 % | ||
| CVE-2024-21677 | >= 6.13.0 ; >= 7.19.0 ; >= 7.20.0 ; … | This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerabilit | HIGH 8.8 | 0.9 % | ||
| CVE-2024-21678 | >= 2.7.0 ; >= 7.13.0 ; >= 7.19.0 ; … | This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, wit | HIGH 8.5 | 0.5 % | ||
| CVE-2024-21674 | >= 7.19.0 ; >= 8.0.0 ; >= 8.1.0 ; … | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote | HIGH 8.6 | 1.8 % | ||
| CVE-2024-21673 | >= 7.13.0 ; >= 7.19.0 ; >= 8.0.0 ; … | This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote | HIGH 8.8 | 1.5 % | ||
| CVE-2024-21672 | >= 7.19.0 ; >= 8.0.0 ; >= 8.1.0 ; … | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote C | HIGH 8.8 | 1.4 % | ||
| CVE-2023-22527 | >= 8.0.0 ; >= 8.1.0 ; >= 8.2.0 ; … | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE | CRITICAL 10.0 | 100 % | KEV | |
| CVE-2023-22526 | >= 7.13.0 ; >= 7.19.0 ; >= 8.0.0 ; … | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote | HIGH 8.8 | 1.6 % | ||
| CVE-2023-22522 | >= 4.0.0 ; >= 7.20.0 ; >= 8.0.0 ; … | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input int | CRITICAL 9.0 | 13 % | ||
| CVE-2023-22518 | >= 1.0.0 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability | CRITICAL 10.0 | 100 % | KEV | |
| CVE-2023-22515 | >= 8.0.0 ; >= 8.0.1 ; >= 8.0.2 ; … | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow | CRITICAL 10.0 | 99 % | KEV | |
| CVE-2023-22508 | >= 6.1.0 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent | HIGH 8.8 | 2.2 % | ||
| CVE-2023-22505 | >= 8.0.0 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Cent | HIGH 8.8 | 2.1 % | ||
| CVE-2023-22504 | >= 1.1.2 ; >= 7.14.0 ; >= 7.20.0 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to u | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-22503 | >= 7.20.2 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and label | MEDIUM 5.3 | 0.8 % | ||
| CVE-2020-36290 | unspecified – < 7.4.5 ; 7.5.0 – < unspecified ; unspecified – < 7.6.3 ; … | The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befo | MEDIUM 5.4 | 0.7 % | ||
| CVE-2022-26137 | | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w | HIGH 8.8 | 2.4 % | ||
| CVE-2022-26136 | | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p | CRITICAL 9.8 | 5.7 % | ||
| CVE-2022-26134 | next of 1.3.0 – < unspecified ; unspecified – < 7.4.17 ; 7.13.0 – < unspecified ; … | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-39114 | unspecified – < 6.13.23 ; 6.14.0 – < unspecified ; unspecified – < 7.4.11 ; … | Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to ex | HIGH 8.8 | 1.7 % | ||
| CVE-2021-43940 | unspecified – < 7.4.10 ; 7.5.0 – < unspecified ; unspecified – < 7.12.3 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the l | HIGH 7.8 | 0.3 % | ||
| CVE-2021-26084 | unspecified – < 6.13.23 ; 6.14.0 – < unspecified ; unspecified – < 7.4.11 ; … | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-26085 | unspecified – < 7.4.10 ; 7.5.0 – < unspecified ; unspecified – < 7.12.3 | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File | MEDIUM 5.3 | 100 % | KEV | |
| CVE-2021-26072 | unspecified – < 5.8.6 | The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the c | MEDIUM 4.3 | 41 % | ||
| CVE-2020-29448 | unspecified – < 6.13.18 ; 6.14.0 – < unspecified ; unspecified – < 7.4.6 ; … | The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7 | MEDIUM 5.3 | 2.6 % | ||
| CVE-2020-4027 | unspecified – < 7.4.5 ; 7.5.0 – < unspecified ; unspecified – < 7.5.1 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass v | MEDIUM 4.7 | 1.5 % | ||
| CVE-2019-20406 | unspecified – < 7.0.5 ; 7.1.0 – < unspecified ; unspecified – < 7.1.1 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1. | HIGH 7.8 | 0.5 % | ||
| CVE-2018-20237 | unspecified – < 6.13.1 | Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word expor | MEDIUM 6.5 | 1.7 % |