Companies/Confluence/CVEs

Confluence CVEs

253 vulnerabilities mapped to Confluence’s software or packages, 11 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-05-08

  CVE-2026-42264 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

  CVSS 7.4 highEPSS 0.77%

• 2026-05-05

  CVE-2026-6322 fast-uri vulnerable to host confusion via percent-encoded authority delimiters

  CVSS 7.5 highEPSS 0.51%

• 2026-05-04

  CVE-2026-6321 fast-uri vulnerable to path traversal via percent-encoded dot segments

  CVSS 7.5 highEPSS 0.63%

• 2026-04-29

  CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

  CVSS 7.5 highEPSS 3.3%

• 2026-04-24

  CVE-2026-42041 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

  CVSS 4.8 mediumEPSS 0.66%

• 2026-04-24

  CVE-2026-42043 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

  CVSS 7.2 highEPSS 0.71%

• 2026-04-24

  CVE-2026-42035 Axios: Header Injection via Prototype Pollution

  CVSS 7.4 highEPSS 0.40%

• 2026-04-24

  CVE-2026-42033 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

  CVSS 7.4 highEPSS 0.87%

• 2026-04-15

  CVE-2025-14813 GOSTCTR implementation unable to process more than 255 blocks correctly

  CVSS 7.5 highEPSS 0.32%

• 2026-04-14

  CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

  CVSS 7.4 highEPSS 1.3%

• 2026-04-10

  CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

  CVSS 4.8 mediumEPSS 1.9%

• 2026-04-09

  CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  CVSS 7.5 highEPSS 0.45%

• 2026-04-09

  CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

  CVSS 7.5 highEPSS 0.46%

• 2026-04-09

  CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

  CVSS 7.5 highEPSS 8.9%

• 2026-04-09

  CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

  CVSS 9.1 criticalEPSS 0.71%

• 2026-04-09

  CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension

  CVSS 7.5 highEPSS 0.70%

• 2026-04-09

  CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

  CVSS 7.0 highEPSS 1.2%

• 2026-03-31

  CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names

  CVSS 8.1 highEPSS 2.8%1 incident

• 2026-03-31

  CVE-2026-34043 Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

  CVSS 5.9 mediumEPSS 0.47%

• 2026-03-27

  CVE-2026-33871 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

  CVSS 7.5 highEPSS 1.1%

• 2026-03-27

  CVE-2026-33870 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

  CVSS 7.5 highEPSS 0.70%

• 2026-03-27

  CVE-2026-33750 brace-expansion: Zero-step sequence causes process hang and memory exhaustion

  CVSS 6.5 mediumEPSS 0.45%

• 2026-03-26

  CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers

  CVSS 7.5 highEPSS 0.42%

• 2026-03-09

  CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

  CVSS 5.5 mediumEPSS 0.26%

• 2026-03-07

  CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

  CVSS 8.6 highEPSS 0.47%

• 2026-03-06

  CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

  CVSS 8.8 highEPSS 1.0%

• 2026-03-06

  CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

  CVSS 7.5 highEPSS 0.57%

• 2026-03-03

  CVE-2026-27601 Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

  CVSS 5.9 mediumEPSS 0.96%

• 2026-02-26

  CVE-2026-27904 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

  CVSS 7.5 highEPSS 0.52%

• 2026-02-26

  CVE-2026-27903 minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

  CVSS 7.5 highEPSS 0.58%

• 2026-02-20

  CVE-2026-26996 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

  CVSS 7.5 highEPSS 0.58%

• 2026-02-20

  CVE-2026-26960 node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

  CVSS 7.1 highEPSS 0.33%

• 2026-02-17

  CVE-2026-24734 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

  CVSS 7.4 highEPSS 0.58%

• 2026-02-09

  CVE-2026-25639 Axios affected by Denial of Service via __proto__ Key in mergeConfig

  CVSS 7.5 highEPSS 2.8%

• 2026-01-28

  CVE-2026-24842 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

  CVSS 8.2 highEPSS 0.61%

• 2026-01-23

  CVE-2026-0603 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

  CVSS 8.3 highEPSS 1.0%

• 2026-01-20

  CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

  CVSS 8.8 highEPSS 0.26%

• 2026-01-16

  CVE-2026-23745 node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

  CVSS 8.2 highEPSS 0.38%

• 2026-01-10

  CVE-2026-22029 React Router vulnerable to XSS via Open Redirects

  CVSS 8.0 highEPSS 0.87%

• 2025-12-17

  CVE-2024-29371

  CVSS 7.5 highEPSS 0.26%

• 2025-12-04

  CVE-2025-66516 Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

  CVSS 8.4 highEPSS 89.0%

• 2025-11-26

  CVE-2025-66020 Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

  CVSS 7.5 highEPSS 0.33%

• 2025-11-17

  CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

  CVSS 7.5 highEPSS 3.1%

• 2025-10-21

  CVE-2025-22166

  CVSS 7.5 highEPSS 0.50%

• 2025-10-01

  CVE-2025-11226 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino

  CVSS 7.0 highEPSS 0.19%

• 2025-09-24

  CVE-2025-59343 tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

  CVSS 8.7 highEPSS 0.55%

• 2025-09-16

  CVE-2025-41249 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

  CVSS 7.5 highEPSS 0.48%

• 2025-09-16

  CVE-2025-41248 CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types

  CVSS 7.5 highEPSS 0.45%

• 2025-08-20

  CVE-2025-54988 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

  CVSS 8.4 highEPSS 47.9%

• 2025-07-14

  CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

  CVSS 8.8 highEPSS 0.54%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)