Companies/Bitbucket/CVEs

Bitbucket CVEs

159 vulnerabilities mapped to Bitbucket’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-05

  CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  CVSS 7.5 highKEV added 2026-10-15EPSS 99.5%

• 2026-08-24

  CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

  CVSS 7.5 highEPSS 0.23%

• 2026-08-24

  CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

  CVSS 7.5 highEPSS 0.22%

• 2026-08-24

  CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

  CVSS 7.5 highEPSS 0.22%

• 2026-08-20

  CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

  CVSS 7.5 highEPSS 0.52%

• 2026-08-18

  CVE-2026-21582

  CVSS 8.8 highEPSS 0.46%

• 2026-08-13

  CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

  CVSS 5.3 mediumEPSS 0.63%

• 2026-08-13

  CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

  CVSS 7.5 highEPSS 0.79%

• 2026-08-11

  CVE-2026-73086 nanoid: Integer Overflow or Wraparound

  CVSS 7.4 highEPSS 0.30%

• 2026-08-03

  CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  CVSS 7.5 highEPSS 0.65%

• 2026-08-03

  CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption

  CVSS 7.5 highEPSS 0.19%

• 2026-08-03

  CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read

  CVSS 7.5 highEPSS 0.49%

• 2026-08-03

  CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

  CVSS 7.5 highEPSS 0.41%

• 2026-08-01

  CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

  CVSS 7.5 highEPSS 0.52%

• 2026-07-31

  CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

  CVSS 7.5 highEPSS 0.38%

• 2026-07-23

  CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

  CVSS 7.5 highEPSS 0.64%

• 2026-07-21

  CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

  CVSS 7.5 highEPSS 0.66%

• 2026-07-21

  CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

  CVSS 7.5 highEPSS 0.63%

• 2026-07-20

  CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

  CVSS 7.5 highEPSS 0.66%

• 2026-07-20

  CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map

  CVSS 7.5 highEPSS 0.66%

• 2026-07-19

  CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter

  CVSS 7.5 highEPSS 0.44%

• 2026-07-08

  CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption

  CVSS 7.5 highEPSS 0.58%

• 2026-07-06

  CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms

  CVSS 5.9 mediumEPSS 0.24%

• 2026-07-01

  CVE-2026-54428 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

  CVSS 7.5 highEPSS 0.87%

• 2026-06-30

  CVE-2026-13149

  CVSS 7.7 highEPSS 0.36%

• 2026-06-29

  CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

  CVSS 7.3 highEPSS 0.65%

• 2026-06-29

  CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization

  CVSS 7.5 highEPSS 0.69%

• 2026-06-16

  CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks

  CVSS 7.5 highEPSS 0.81%

• 2026-06-12

  CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

  CVSS 7.5 highEPSS 0.67%

• 2026-06-12

  CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification

  CVSS 7.5 highEPSS 0.49%

• 2026-06-12

  CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

  CVSS 5.3 mediumEPSS 0.75%

• 2026-06-12

  CVE-2026-45416 Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

  CVSS 7.5 highEPSS 0.92%

• 2026-06-11

  CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

  CVSS 8.1 highEPSS 0.99%

• 2026-06-11

  CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

  CVSS 7.5 highEPSS 0.55%

• 2026-06-11

  CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

  CVSS 7.5 highEPSS 0.69%

• 2026-06-11

  CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios

  CVSS 7.5 highEPSS 0.67%

• 2026-06-11

  CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

  CVSS 4.8 mediumEPSS 0.33%

• 2026-06-11

  CVE-2026-44496 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

  CVSS 7.5 highEPSS 5.4%

• 2026-06-11

  CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

  CVSS 7.0 highEPSS 0.85%

• 2026-06-11

  CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

  CVSS 8.7 highEPSS 1.0%

• 2026-06-11

  CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

  CVSS 8.6 highEPSS 12.9%

• 2026-06-10

  CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

  CVSS 7.5 highEPSS 0.92%

• 2026-06-09

  CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates

  CVSS 6.8 mediumEPSS 0.13%

• 2026-06-09

  CVE-2026-40983 Micrometer gRPC server instrumentation DoS vulnerability

  CVSS 7.5 highEPSS 0.63%

• 2026-05-29

  CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection

  CVSS 6.5 mediumEPSS 0.30%

• 2026-05-15

  CVE-2026-45736 ws: Uninitialized memory disclosure

  CVSS 4.4 mediumEPSS 0.74%

• 2026-05-13

  CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

  CVSS 6.5 mediumEPSS 0.27%

• 2026-05-13

  CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion

  CVSS 7.5 highEPSS 0.46%

• 2026-05-12

  CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

  CVSS 7.5 highEPSS 0.84%

• 2026-05-05

  CVE-2026-6322 fast-uri vulnerable to host confusion via percent-encoded authority delimiters

  CVSS 7.5 highEPSS 0.51%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)