Companies/Jira/CVEs

Jira CVEs

278 vulnerabilities mapped to Jira’s software or packages, 5 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-06-09

  CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates

  CVSS 6.8 mediumEPSS 0.13%

• 2026-06-09

  CVE-2026-41845 Spring Framework Cross-site Scripting via JavaScriptUtils

  CVSS 7.1 highEPSS 0.16%

• 2026-06-09

  CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

  CVSS 7.5 highEPSS 0.40%

• 2026-06-09

  CVE-2026-40983 Micrometer gRPC server instrumentation DoS vulnerability

  CVSS 7.5 highEPSS 0.63%

• 2026-06-02

  CVE-2026-42342 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

  CVSS 7.5 highEPSS 0.30%

• 2026-06-02

  CVE-2026-42211 React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

  CVSS 8.1 highEPSS 0.42%

• 2026-06-02

  CVE-2026-34077 React Router vulnerable to Denial of Service via reflected user input in single-fetch

  CVSS 7.5 highEPSS 0.29%

• 2026-05-28

  CVE-2026-47762 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

  CVSS 8.7 highEPSS 0.28%

• 2026-05-28

  CVE-2026-47761 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

  CVSS 8.7 highEPSS 0.26%

• 2026-05-28

  CVE-2026-47759 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

  CVSS 8.7 highEPSS 0.28%

• 2026-05-26

  CVE-2026-44728 Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

  CVSS 8.2 highEPSS 0.12%

• 2026-05-13

  CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

  CVSS 7.5 highEPSS 0.99%

• 2026-05-13

  CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

  CVSS 6.5 mediumEPSS 0.27%

• 2026-05-13

  CVE-2026-42584 Netty: HttpClientCodec response desynchronization

  CVSS 7.3 highEPSS 0.84%

• 2026-05-13

  CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion

  CVSS 7.5 highEPSS 0.46%

• 2026-05-13

  CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

  CVSS 5.8 mediumEPSS 0.63%

• 2026-05-12

  CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied

  CVSS 9.1 criticalEPSS 1.2%

• 2026-05-12

  CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

  CVSS 7.5 highEPSS 0.50%

• 2026-05-12

  CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

  CVSS 9.8 criticalEPSS 1.3%

• 2026-05-12

  CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

  CVSS 9.8 criticalEPSS 1.7%

• 2026-05-12

  CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure

  CVSS 7.3 highEPSS 0.65%

• 2026-05-12

  CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

  CVSS 7.5 highEPSS 0.84%

• 2026-05-08

  CVE-2026-42264 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

  CVSS 7.4 highEPSS 0.77%

• 2026-05-05

  CVE-2026-6322 fast-uri vulnerable to host confusion via percent-encoded authority delimiters

  CVSS 7.5 highEPSS 0.51%

• 2026-05-04

  CVE-2026-6321 fast-uri vulnerable to path traversal via percent-encoded dot segments

  CVSS 7.5 highEPSS 0.63%

• 2026-04-29

  CVE-2026-42198 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

  CVSS 7.5 highEPSS 3.3%

• 2026-04-24

  CVE-2026-42038 Axios: no_proxy bypass via IP alias allows SSRF

  CVSS 6.8 mediumEPSS 0.32%

• 2026-04-24

  CVE-2026-42043 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

  CVSS 7.2 highEPSS 0.71%

• 2026-04-24

  CVE-2026-42044 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

  CVSS 6.5 mediumEPSS 0.61%

• 2026-04-24

  CVE-2026-42035 Axios: Header Injection via Prototype Pollution

  CVSS 7.4 highEPSS 0.40%

• 2026-04-24

  CVE-2026-42033 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

  CVSS 7.4 highEPSS 0.87%

• 2026-04-15

  CVE-2025-14813 GOSTCTR implementation unable to process more than 255 blocks correctly

  CVSS 7.5 highEPSS 0.32%

• 2026-04-10

  CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

  CVSS 4.8 mediumEPSS 1.9%

• 2026-04-09

  CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  CVSS 7.5 highEPSS 0.45%

• 2026-04-09

  CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

  CVSS 7.5 highEPSS 0.46%

• 2026-04-09

  CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

  CVSS 7.5 highEPSS 8.9%

• 2026-04-09

  CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

  CVSS 9.1 criticalEPSS 0.71%

• 2026-04-09

  CVE-2026-29129 Apache Tomcat: TLS cipher order is not preserved

  CVSS 7.5 highEPSS 0.26%

• 2026-03-31

  CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names

  CVSS 8.1 highEPSS 2.8%1 incident

• 2026-03-27

  CVE-2026-33871 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

  CVSS 7.5 highEPSS 1.1%

• 2026-03-27

  CVE-2026-33870 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

  CVSS 7.5 highEPSS 0.70%

• 2026-03-27

  CVE-2026-33750 brace-expansion: Zero-step sequence causes process hang and memory exhaustion

  CVSS 6.5 mediumEPSS 0.45%

• 2026-03-19

  CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written

  CVSS 9.1 criticalEPSS 0.49%

• 2026-03-09

  CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

  CVSS 5.5 mediumEPSS 0.26%

• 2026-03-07

  CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

  CVSS 8.6 highEPSS 0.47%

• 2026-03-06

  CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

  CVSS 8.8 highEPSS 1.0%

• 2026-03-06

  CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

  CVSS 7.5 highEPSS 0.57%

• 2026-02-26

  CVE-2026-27904 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

  CVSS 7.5 highEPSS 0.52%

• 2026-02-26

  CVE-2026-27903 minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

  CVSS 7.5 highEPSS 0.58%

• 2026-02-25

  CVE-2026-27606 Rollup 4 has Arbitrary File Write via Path Traversal

  CVSS 9.1 criticalEPSS 1.7%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)