# Jira CVEs > Jira: 278 CVEs mapped to its software or packages (5 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/jira/cves Last updated: 2026-10-15T04:00:00Z 278 CVEs map to Jira (5 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Jira](https://rewindex.com/company/jira.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Jira’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-05 | [CVE-2026-21589](https://rewindex.com/cve/CVE-2026-21589.md) | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 7.5 high | yes (2026-10-15) | | 2026-10-02 | [CVE-2026-18036](https://rewindex.com/cve/CVE-2026-18036.md) | NTRU leaks private key information by reducing secret values with a non-constant-time integer division | 8.2 high | | | 2026-10-01 | [CVE-2026-68495](https://rewindex.com/cve/CVE-2026-68495.md) | jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service | 7.5 high | | | 2026-09-28 | [CVE-2026-101909](https://rewindex.com/cve/CVE-2026-101909.md) | Axios: Prototype Pollution Gadget in axios toFormData Options | 8.3 high | | | 2026-09-28 | [CVE-2026-101906](https://rewindex.com/cve/CVE-2026-101906.md) | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location | 8.2 high | | | 2026-09-28 | [CVE-2026-101905](https://rewindex.com/cve/CVE-2026-101905.md) | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection | 7.6 high | | | 2026-09-28 | [CVE-2026-101903](https://rewindex.com/cve/CVE-2026-101903.md) | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) | 8.2 high | | | 2026-09-28 | [CVE-2026-101901](https://rewindex.com/cve/CVE-2026-101901.md) | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization | 8.2 high | | | 2026-09-28 | [CVE-2026-101898](https://rewindex.com/cve/CVE-2026-101898.md) | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | 7.0 high | | | 2026-09-18 | [CVE-2026-93748](https://rewindex.com/cve/CVE-2026-93748.md) | http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale | 7.5 high | | | 2026-09-15 | [CVE-2026-21587](https://rewindex.com/cve/CVE-2026-21587.md) | | 7.1 high | | | 2026-09-04 | [CVE-2026-19534](https://rewindex.com/cve/CVE-2026-19534.md) | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol | 7.5 high | | | 2026-09-02 | [CVE-2026-84292](https://rewindex.com/cve/CVE-2026-84292.md) | fast-uri vulnerable to authority injection via an unvalidated port in serialize | 7.5 high | | | 2026-09-01 | [CVE-2026-84375](https://rewindex.com/cve/CVE-2026-84375.md) | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | 7.5 high | | | 2026-08-25 | [CVE-2026-68763](https://rewindex.com/cve/CVE-2026-68763.md) | Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset | 7.5 high | | | 2026-08-25 | [CVE-2026-68569](https://rewindex.com/cve/CVE-2026-68569.md) | Apache Tomcat: Principal lookup can fail open in some cases | 8.1 high | | | 2026-08-25 | [CVE-2026-66422](https://rewindex.com/cve/CVE-2026-66422.md) | Apache Tomcat: Servlet role references can bypass declarative role constraints | 8.1 high | | | 2026-08-25 | [CVE-2026-65927](https://rewindex.com/cve/CVE-2026-65927.md) | Apache Tomcat: RewriteValve \[N\] restarts at the second rule and may bypass access control | 7.5 high | | | 2026-08-25 | [CVE-2026-65637](https://rewindex.com/cve/CVE-2026-65637.md) | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete | 9.8 critical | | | 2026-08-25 | [CVE-2026-65183](https://rewindex.com/cve/CVE-2026-65183.md) | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets | 8.1 high | | | 2026-08-24 | [CVE-2026-76172](https://rewindex.com/cve/CVE-2026-76172.md) | fast-uri vulnerable to host confusion via percent-encoded scheme normalization | 7.5 high | | | 2026-08-24 | [CVE-2026-75975](https://rewindex.com/cve/CVE-2026-75975.md) | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization | 7.5 high | | | 2026-08-24 | [CVE-2026-75899](https://rewindex.com/cve/CVE-2026-75899.md) | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding | 7.5 high | | | 2026-08-22 | [CVE-2026-62243](https://rewindex.com/cve/CVE-2026-62243.md) | Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass | 7.5 high | | | 2026-08-20 | [CVE-2026-75140](https://rewindex.com/cve/CVE-2026-75140.md) | jsoup Uncontrolled Resource Consumption in XmlTreeBuilder | 7.5 high | | | 2026-08-19 | [CVE-2026-75595](https://rewindex.com/cve/CVE-2026-75595.md) | Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext | 9.1 critical | | | 2026-08-19 | [CVE-2026-75596](https://rewindex.com/cve/CVE-2026-75596.md) | Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing | 7.5 high | | | 2026-08-18 | [CVE-2026-21582](https://rewindex.com/cve/CVE-2026-21582.md) | | 8.8 high | | | 2026-08-17 | [CVE-2026-59903](https://rewindex.com/cve/CVE-2026-59903.md) | Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite | 6.5 medium | | | 2026-08-17 | [CVE-2026-73646](https://rewindex.com/cve/CVE-2026-73646.md) | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure | 7.5 high | | | 2026-08-13 | [CVE-2026-73566](https://rewindex.com/cve/CVE-2026-73566.md) | node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection | 7.5 high | | | 2026-08-13 | [CVE-2026-73507](https://rewindex.com/cve/CVE-2026-73507.md) | Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion | 7.5 high | | | 2026-08-11 | [CVE-2026-73089](https://rewindex.com/cve/CVE-2026-73089.md) | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM | 7.5 high | | | 2026-08-11 | [CVE-2026-73088](https://rewindex.com/cve/CVE-2026-73088.md) | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) | 7.5 high | | | 2026-08-11 | [CVE-2026-73086](https://rewindex.com/cve/CVE-2026-73086.md) | nanoid: Integer Overflow or Wraparound | 7.4 high | | | 2026-08-04 | [CVE-2026-68494](https://rewindex.com/cve/CVE-2026-68494.md) | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) | 8.7 high | | | 2026-04-09 | [CVE-2026-34486](https://rewindex.com/cve/CVE-2026-34486.md) | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | 7.5 high | yes (2026-08-04) | | 2026-08-03 | [CVE-2026-69192](https://rewindex.com/cve/CVE-2026-69192.md) | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass | 7.7 high | | | 2026-08-03 | [CVE-2026-69152](https://rewindex.com/cve/CVE-2026-69152.md) | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation | 7.5 high | | | 2026-08-03 | [CVE-2026-13506](https://rewindex.com/cve/CVE-2026-13506.md) | Lazy ASN.1 sequence forcing resets nesting-depth guard | 7.5 high | | | 2026-08-03 | [CVE-2026-12860](https://rewindex.com/cve/CVE-2026-12860.md) | RSA PKCS\#1 verification skips last two hash bytes in NULL-omitted path | 5.3 medium | | | 2026-08-03 | [CVE-2026-12816](https://rewindex.com/cve/CVE-2026-12816.md) | IESEngine stream-mode MAC forgery via length-dependent KDF split | 7.5 high | | | 2026-08-03 | [CVE-2026-12803](https://rewindex.com/cve/CVE-2026-12803.md) | KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) | 7.5 high | | | 2026-08-03 | [CVE-2026-12802](https://rewindex.com/cve/CVE-2026-12802.md) | CMS AuthEnvelopedData fails to enforce tag-length on decryption | 7.5 high | | | 2026-08-03 | [CVE-2026-14682](https://rewindex.com/cve/CVE-2026-14682.md) | Possible OOM from unbounded up-front allocation on a definite-length read | 7.5 high | | | 2026-08-03 | [CVE-2026-58059](https://rewindex.com/cve/CVE-2026-58059.md) | Quadratic-time escaping when stringifying X.500 distinguished names | 7.5 high | | | 2026-08-03 | [CVE-2026-58060](https://rewindex.com/cve/CVE-2026-58060.md) | HSS public-key level count unbounded, enabling huge allocation on verify | 7.5 high | | | 2026-08-03 | [CVE-2026-58061](https://rewindex.com/cve/CVE-2026-58061.md) | CCM-family modes write plaintext to caller buffer before tag check | 7.5 high | | | 2026-08-03 | [CVE-2026-58062](https://rewindex.com/cve/CVE-2026-58062.md) | Stapled OCSP response accepted without binding to the checked certificate | 9.1 critical | | | 2026-08-03 | [CVE-2026-59639](https://rewindex.com/cve/CVE-2026-59639.md) | CMS verifySignatures returns true for SignedData with zero signers | 7.5 high | | Next page: [page 2](https://rewindex.com/company/jira/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Jira) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 1 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-01-05 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-02 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 1 | 0 | 1 | 0 | 0 | | 2026-02-16 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-02-23 | 1 | 2 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-03-16 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 2 | 1 | 0 | 0 | 0 | | 2026-03-30 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-06 | 1 | 5 | 1 | 0 | 0 | 0 | | 2026-04-13 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 3 | 2 | 0 | 0 | 0 | | 2026-04-27 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-05-11 | 3 | 6 | 2 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 4 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 16 | 3 | 0 | 0 | 0 | | 2026-06-15 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-06-29 | 2 | 3 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 6 | 2 | 0 | 0 | 0 | | 2026-07-13 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 5 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 4 | 2 | 0 | 0 | 0 | | 2026-08-03 | 3 | 16 | 1 | 0 | 0 | 1 | | 2026-08-10 | 0 | 5 | 0 | 0 | 0 | 0 | | 2026-08-17 | 1 | 5 | 1 | 0 | 0 | 0 | | 2026-08-24 | 1 | 8 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 8 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/jira/cves · Markdown: https://rewindex.com/company/jira/cves.md · JSON: https://rewindex.com/api/v1/companies/jira/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:20.034Z