Companies/Jira/CVEs

Jira CVEs

278 vulnerabilities mapped to Jira’s software or packages, 5 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-05

  CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  CVSS 7.5 highKEV added 2026-10-15EPSS 99.5%

• 2026-10-02

  CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division

  CVSS 8.2 highEPSS 0.28%

• 2026-10-01

  CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

  CVSS 7.5 highEPSS 0.56%

• 2026-09-28

  CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

  CVSS 8.3 highEPSS 0.50%

• 2026-09-28

  CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

  CVSS 8.2 highEPSS 0.46%

• 2026-09-28

  CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

  CVSS 7.6 highEPSS 0.42%

• 2026-09-28

  CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

  CVSS 8.2 highEPSS 0.44%

• 2026-09-28

  CVE-2026-101901 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

  CVSS 8.2 highEPSS 0.54%

• 2026-09-28

  CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

  CVSS 7.0 highEPSS 0.55%

• 2026-09-18

  CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

  CVSS 7.5 highEPSS 0.57%

• 2026-09-15

  CVE-2026-21587

  CVSS 7.1 highEPSS 0.44%

• 2026-09-04

  CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

  CVSS 7.5 highEPSS 0.39%

• 2026-09-02

  CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

  CVSS 7.5 highEPSS 0.24%

• 2026-09-01

  CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

  CVSS 7.5 highEPSS 0.54%

• 2026-08-25

  CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

  CVSS 7.5 highEPSS 0.74%

• 2026-08-25

  CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

  CVSS 8.1 highEPSS 0.46%

• 2026-08-25

  CVE-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints

  CVSS 8.1 highEPSS 0.43%

• 2026-08-25

  CVE-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

  CVSS 7.5 highEPSS 0.68%

• 2026-08-25

  CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

  CVSS 9.8 criticalEPSS 0.61%

• 2026-08-25

  CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

  CVSS 8.1 highEPSS 0.40%

• 2026-08-24

  CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

  CVSS 7.5 highEPSS 0.23%

• 2026-08-24

  CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

  CVSS 7.5 highEPSS 0.22%

• 2026-08-24

  CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

  CVSS 7.5 highEPSS 0.22%

• 2026-08-22

  CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

  CVSS 7.5 highEPSS 0.16%

• 2026-08-20

  CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

  CVSS 7.5 highEPSS 0.52%

• 2026-08-19

  CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

  CVSS 9.1 criticalEPSS 0.32%

• 2026-08-19

  CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

  CVSS 7.5 highEPSS 0.37%

• 2026-08-18

  CVE-2026-21582

  CVSS 8.8 highEPSS 0.46%

• 2026-08-17

  CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

  CVSS 6.5 mediumEPSS 0.32%

• 2026-08-17

  CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

  CVSS 7.5 highEPSS 0.53%

• 2026-08-13

  CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

  CVSS 7.5 highEPSS 0.53%

• 2026-08-13

  CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

  CVSS 7.5 highEPSS 0.79%

• 2026-08-11

  CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

  CVSS 7.5 highEPSS 0.66%

• 2026-08-11

  CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

  CVSS 7.5 highEPSS 0.66%

• 2026-08-11

  CVE-2026-73086 nanoid: Integer Overflow or Wraparound

  CVSS 7.4 highEPSS 0.30%

• 2026-08-04

  CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)

  CVSS 8.7 highEPSS 0.46%

• 2026-04-09

  CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  CVSS 7.5 highKEV added 2026-08-04EPSS 98.5%

• 2026-08-03

  CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

  CVSS 7.7 highEPSS 0.47%

• 2026-08-03

  CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  CVSS 7.5 highEPSS 0.65%

• 2026-08-03

  CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard

  CVSS 7.5 highEPSS 0.49%

• 2026-08-03

  CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path

  CVSS 5.3 mediumEPSS 0.17%

• 2026-08-03

  CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split

  CVSS 7.5 highEPSS 0.18%

• 2026-08-03

  CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

  CVSS 7.5 highEPSS 0.24%

• 2026-08-03

  CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption

  CVSS 7.5 highEPSS 0.19%

• 2026-08-03

  CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read

  CVSS 7.5 highEPSS 0.49%

• 2026-08-03

  CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names

  CVSS 7.5 highEPSS 0.49%

• 2026-08-03

  CVE-2026-58060 HSS public-key level count unbounded, enabling huge allocation on verify

  CVSS 7.5 highEPSS 0.62%

• 2026-08-03

  CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check

  CVSS 7.5 highEPSS 0.28%

• 2026-08-03

  CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate

  CVSS 9.1 criticalEPSS 0.36%

• 2026-08-03

  CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers

  CVSS 7.5 highEPSS 0.24%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)