Companies/Jira/CVEs

Jira CVEs

278 vulnerabilities mapped to Jira’s software or packages, 5 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-08-03

  CVE-2026-59642 CMS AuthenticatedData content not bound to MAC when authAttrs present

  CVSS 7.5 highEPSS 0.30%

• 2026-08-03

  CVE-2026-59645 OER parser recurses without depth limit on self-referential IEEE 1609.2 schema

  CVSS 7.5 highEPSS 0.41%

• 2026-08-03

  CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value

  CVSS 9.1 criticalEPSS 0.34%

• 2026-08-03

  CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key

  CVSS 7.5 highEPSS 0.20%

• 2026-08-03

  CVE-2026-12185 BKS/UBER keystore allocates from untrusted lengths before integrity check

  CVSS 8.6 highEPSS 0.29%

• 2026-08-03

  CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI

  CVSS 9.1 criticalEPSS 0.43%

• 2026-08-01

  CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

  CVSS 7.5 highEPSS 0.52%

• 2026-07-31

  CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

  CVSS 7.5 highEPSS 0.38%

• 2026-07-29

  CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

  CVSS 7.5 highEPSS 0.46%

• 2026-07-29

  CVE-2026-67214 nanoid Infinite Loop via Negative Size in non-secure module

  CVSS 5.9 mediumEPSS 0.33%

• 2026-07-29

  CVE-2026-67213 nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

  CVSS 5.9 mediumEPSS 0.33%

• 2026-07-27

  CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

  CVSS 7.5 highEPSS 0.71%

• 2026-07-23

  CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

  CVSS 7.5 highEPSS 0.64%

• 2026-07-21

  CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

  CVSS 7.5 highEPSS 0.66%

• 2026-07-21

  CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

  CVSS 7.5 highEPSS 0.63%

• 2026-07-20

  CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

  CVSS 7.5 highEPSS 0.66%

• 2026-07-20

  CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map

  CVSS 7.5 highEPSS 0.66%

• 2026-07-19

  CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter

  CVSS 7.5 highEPSS 0.44%

• 2026-07-14

  CVE-2026-48801 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

  CVSS 7.5 highEPSS 0.39%

• 2026-07-08

  CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

  CVSS 7.5 highEPSS 0.64%

• 2026-07-08

  CVE-2026-59879 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

  CVSS 7.5 highEPSS 0.58%

• 2026-07-08

  CVE-2026-59880 Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

  CVSS 7.5 highEPSS 0.66%

• 2026-07-08

  CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion

  CVSS 5.3 mediumEPSS 0.64%

• 2026-07-08

  CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace

  CVSS 7.5 highEPSS 0.43%

• 2026-07-08

  CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input

  CVSS 7.5 highEPSS 0.58%

• 2026-07-08

  CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption

  CVSS 7.5 highEPSS 0.58%

• 2026-07-06

  CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms

  CVSS 5.9 mediumEPSS 0.24%

• 2026-06-30

  CVE-2026-13149

  CVSS 7.7 highEPSS 0.36%

• 2026-06-29

  CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

  CVSS 9.1 criticalEPSS 0.61%

• 2026-06-29

  CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

  CVSS 9.1 criticalEPSS 0.59%

• 2026-06-29

  CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

  CVSS 7.3 highEPSS 0.65%

• 2026-06-29

  CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization

  CVSS 7.5 highEPSS 0.69%

• 2026-06-23

  CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

  CVSS 8.1 highEPSS 0.94%

• 2026-06-23

  CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

  CVSS 8.1 highEPSS 1.2%

• 2026-06-17

  CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass

  CVSS 7.5 highEPSS 0.79%

• 2026-06-12

  CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

  CVSS 7.5 highEPSS 0.67%

• 2026-06-12

  CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification

  CVSS 7.5 highEPSS 0.49%

• 2026-06-12

  CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

  CVSS 5.3 mediumEPSS 0.75%

• 2026-06-12

  CVE-2026-45416 Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

  CVSS 7.5 highEPSS 0.92%

• 2026-06-11

  CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

  CVSS 8.1 highEPSS 0.99%

• 2026-06-11

  CVE-2026-44705 tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

  CVSS 8.2 highEPSS 0.43%

• 2026-06-11

  CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

  CVSS 7.5 highEPSS 0.55%

• 2026-06-11

  CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

  CVSS 7.5 highEPSS 0.69%

• 2026-06-11

  CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios

  CVSS 7.5 highEPSS 0.67%

• 2026-06-11

  CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

  CVSS 4.8 mediumEPSS 0.33%

• 2026-06-11

  CVE-2026-44496 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

  CVSS 7.5 highEPSS 5.4%

• 2026-06-11

  CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

  CVSS 7.0 highEPSS 0.85%

• 2026-06-11

  CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

  CVSS 8.7 highEPSS 1.0%

• 2026-06-11

  CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

  CVSS 8.6 highEPSS 12.9%

• 2026-06-10

  CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

  CVSS 7.5 highEPSS 0.92%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)