# Bitbucket CVEs > Bitbucket: 159 CVEs mapped to its software or packages (2 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/bitbucket/cves Last updated: 2026-10-15T04:00:00Z 159 CVEs map to Bitbucket (2 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Bitbucket](https://rewindex.com/company/bitbucket.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Bitbucket’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-05 | [CVE-2026-21589](https://rewindex.com/cve/CVE-2026-21589.md) | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 7.5 high | yes (2026-10-15) | | 2026-08-24 | [CVE-2026-76172](https://rewindex.com/cve/CVE-2026-76172.md) | fast-uri vulnerable to host confusion via percent-encoded scheme normalization | 7.5 high | | | 2026-08-24 | [CVE-2026-75975](https://rewindex.com/cve/CVE-2026-75975.md) | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization | 7.5 high | | | 2026-08-24 | [CVE-2026-75899](https://rewindex.com/cve/CVE-2026-75899.md) | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding | 7.5 high | | | 2026-08-20 | [CVE-2026-75140](https://rewindex.com/cve/CVE-2026-75140.md) | jsoup Uncontrolled Resource Consumption in XmlTreeBuilder | 7.5 high | | | 2026-08-18 | [CVE-2026-21582](https://rewindex.com/cve/CVE-2026-21582.md) | | 8.8 high | | | 2026-08-13 | [CVE-2026-73508](https://rewindex.com/cve/CVE-2026-73508.md) | Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names | 5.3 medium | | | 2026-08-13 | [CVE-2026-73507](https://rewindex.com/cve/CVE-2026-73507.md) | Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion | 7.5 high | | | 2026-08-11 | [CVE-2026-73086](https://rewindex.com/cve/CVE-2026-73086.md) | nanoid: Integer Overflow or Wraparound | 7.4 high | | | 2026-08-03 | [CVE-2026-69152](https://rewindex.com/cve/CVE-2026-69152.md) | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation | 7.5 high | | | 2026-08-03 | [CVE-2026-12802](https://rewindex.com/cve/CVE-2026-12802.md) | CMS AuthEnvelopedData fails to enforce tag-length on decryption | 7.5 high | | | 2026-08-03 | [CVE-2026-14682](https://rewindex.com/cve/CVE-2026-14682.md) | Possible OOM from unbounded up-front allocation on a definite-length read | 7.5 high | | | 2026-08-03 | [CVE-2026-59645](https://rewindex.com/cve/CVE-2026-59645.md) | OER parser recurses without depth limit on self-referential IEEE 1609.2 schema | 7.5 high | | | 2026-08-01 | [CVE-2026-67320](https://rewindex.com/cve/CVE-2026-67320.md) | axios before 0.33.0 Prototype Pollution via Node HTTP adapter | 7.5 high | | | 2026-07-31 | [CVE-2026-18446](https://rewindex.com/cve/CVE-2026-18446.md) | fast-uri vulnerable to host confusion via backslash authority introducer | 7.5 high | | | 2026-07-23 | [CVE-2026-14257](https://rewindex.com/cve/CVE-2026-14257.md) | brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash | 7.5 high | | | 2026-07-21 | [CVE-2026-56819](https://rewindex.com/cve/CVE-2026-56819.md) | Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) | 7.5 high | | | 2026-07-21 | [CVE-2026-56745](https://rewindex.com/cve/CVE-2026-56745.md) | Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST\_STREAM Leads to Native Memory Exhaustion | 7.5 high | | | 2026-07-20 | [CVE-2026-55833](https://rewindex.com/cve/CVE-2026-55833.md) | Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation | 7.5 high | | | 2026-07-20 | [CVE-2026-55831](https://rewindex.com/cve/CVE-2026-55831.md) | Netty SPDY SETTINGS frame count materializes unbounded settings map | 7.5 high | | | 2026-07-19 | [CVE-2026-16221](https://rewindex.com/cve/CVE-2026-16221.md) | fast-uri vulnerable to host confusion via literal backslash authority delimiter | 7.5 high | | | 2026-07-08 | [CVE-2026-59869](https://rewindex.com/cve/CVE-2026-59869.md) | js-yaml: YAML merge-key chains can force quadratic CPU consumption | 7.5 high | | | 2026-07-06 | [CVE-2026-54291](https://rewindex.com/cve/CVE-2026-54291.md) | Silent channel-binding authentication downgrade via unsupported certificate algorithms | 5.9 medium | | | 2026-07-01 | [CVE-2026-54428](https://rewindex.com/cve/CVE-2026-54428.md) | Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK | 7.5 high | | | 2026-06-30 | [CVE-2026-13149](https://rewindex.com/cve/CVE-2026-13149.md) | | 7.7 high | | | 2026-06-29 | [CVE-2026-53404](https://rewindex.com/cve/CVE-2026-53404.md) | Apache Tomcat: Bad ornext processing in RewriteValve | 7.3 high | | | 2026-06-29 | [CVE-2026-13676](https://rewindex.com/cve/CVE-2026-13676.md) | fast-uri vulnerable to host confusion via failed IDN canonicalization | 7.5 high | | | 2026-06-16 | [CVE-2026-48779](https://rewindex.com/cve/CVE-2026-48779.md) | ws: Memory exhaustion DoS from tiny fragments and data chunks | 7.5 high | | | 2026-06-12 | [CVE-2026-12143](https://rewindex.com/cve/CVE-2026-12143.md) | form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) | 7.5 high | | | 2026-06-12 | [CVE-2026-50010](https://rewindex.com/cve/CVE-2026-50010.md) | Netty's wrapping plain trust manager silently disables hostname verification | 7.5 high | | | 2026-06-12 | [CVE-2026-48043](https://rewindex.com/cve/CVE-2026-48043.md) | netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion | 5.3 medium | | | 2026-06-12 | [CVE-2026-45416](https://rewindex.com/cve/CVE-2026-45416.md) | Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes | 7.5 high | | | 2026-06-11 | [CVE-2026-44249](https://rewindex.com/cve/CVE-2026-44249.md) | Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking | 8.1 high | | | 2026-06-11 | [CVE-2026-44486](https://rewindex.com/cve/CVE-2026-44486.md) | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection | 7.5 high | | | 2026-06-11 | [CVE-2026-44487](https://rewindex.com/cve/CVE-2026-44487.md) | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter | 7.5 high | | | 2026-06-11 | [CVE-2026-44488](https://rewindex.com/cve/CVE-2026-44488.md) | Axios: Allocation of Resources Without Limits or Throttling in axios | 7.5 high | | | 2026-06-11 | [CVE-2026-44490](https://rewindex.com/cve/CVE-2026-44490.md) | Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions | 4.8 medium | | | 2026-06-11 | [CVE-2026-44496](https://rewindex.com/cve/CVE-2026-44496.md) | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection | 7.5 high | | | 2026-06-11 | [CVE-2026-44495](https://rewindex.com/cve/CVE-2026-44495.md) | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge | 7.0 high | | | 2026-06-11 | [CVE-2026-44494](https://rewindex.com/cve/CVE-2026-44494.md) | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in \`config.proxy\` | 8.7 high | | | 2026-06-11 | [CVE-2026-44492](https://rewindex.com/cve/CVE-2026-44492.md) | Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO\_PROXY bypass (incomplete fix for CVE-2025-62718) | 8.6 high | | | 2026-06-10 | [CVE-2026-46625](https://rewindex.com/cve/CVE-2026-46625.md) | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection | 7.5 high | | | 2026-06-09 | [CVE-2026-47838](https://rewindex.com/cve/CVE-2026-47838.md) | Unauthorized User Impersonation when Using X.509 Client Certificates | 6.8 medium | | | 2026-06-09 | [CVE-2026-40983](https://rewindex.com/cve/CVE-2026-40983.md) | Micrometer gRPC server instrumentation DoS vulnerability | 7.5 high | | | 2026-05-29 | [CVE-2026-45149](https://rewindex.com/cve/CVE-2026-45149.md) | brace-expansion: Large numeric range defeats documented \`max\` DoS protection | 6.5 medium | | | 2026-05-15 | [CVE-2026-45736](https://rewindex.com/cve/CVE-2026-45736.md) | ws: Uninitialized memory disclosure | 4.4 medium | | | 2026-05-13 | [CVE-2026-42585](https://rewindex.com/cve/CVE-2026-42585.md) | Netty: HTTP Request Smuggling due to malformed Transfer-Encoding | 6.5 medium | | | 2026-05-13 | [CVE-2026-42583](https://rewindex.com/cve/CVE-2026-42583.md) | Netty: Lz4FrameDecoder resource exhaustion | 7.5 high | | | 2026-05-12 | [CVE-2026-41284](https://rewindex.com/cve/CVE-2026-41284.md) | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | 7.5 high | | | 2026-05-05 | [CVE-2026-6322](https://rewindex.com/cve/CVE-2026-6322.md) | fast-uri vulnerable to host confusion via percent-encoded authority delimiters | 7.5 high | | Next page: [page 2](https://rewindex.com/company/bitbucket/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Bitbucket) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 2 | 1 | 0 | 0 | 0 | | 2026-03-30 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 2 | 2 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 2 | 2 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 13 | 3 | 0 | 0 | 0 | | 2026-06-15 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 4 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-07-13 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 5 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 4 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 2 | 1 | 0 | 0 | 0 | | 2026-08-17 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/bitbucket/cves · Markdown: https://rewindex.com/company/bitbucket/cves.md · JSON: https://rewindex.com/api/v1/companies/bitbucket/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:59.738Z