CVEs for Confluence
253 matching vulnerabilities, 11 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
CVSS 7.5 highKEV added EPSS 99.5%BitbucketConfluenceJira
CVSS 7.1 highEPSS 0.40%Confluence
CVSS 7.1 highEPSS 0.44%Confluence
CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases
CVSS 8.1 highEPSS 0.46%ConfluenceJira
CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
CVSS 9.1 criticalEPSS 0.49%Confluence
CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication
CVSS 9.8 criticalEPSS 0.56%Confluence
CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint
CVSS 9.1 criticalEPSS 0.54%Confluence
CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
CVSS 7.5 highEPSS 0.16%ConfluenceJira
CVSS 8.6 highEPSS 0.51%Confluence
CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
CVSS 5.3 mediumEPSS 0.63%BitbucketConfluence
CVE-2026-73086 nanoid: Integer Overflow or Wraparound
CVSS 7.4 highEPSS 0.30%BitbucketConfluenceJira
CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard
CVSS 7.5 highEPSS 0.49%ConfluenceJira
CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
CVSS 5.3 mediumEPSS 0.17%ConfluenceJira
CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split
CVSS 7.5 highEPSS 0.18%ConfluenceJira
CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names
CVSS 7.5 highEPSS 0.49%ConfluenceJira
CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check
CVSS 7.5 highEPSS 0.28%ConfluenceJira
CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate
CVSS 9.1 criticalEPSS 0.36%ConfluenceJira
CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers
CVSS 7.5 highEPSS 0.24%ConfluenceJira
CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation
CVSS 5.3 mediumEPSS 0.18%Confluence
CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value
CVSS 9.1 criticalEPSS 0.34%ConfluenceJira
CVE-2026-59651 BKS keystore accepts legacy version with 16-bit integrity MAC key
CVSS 7.5 highEPSS 0.20%ConfluenceJira
CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI
CVSS 9.1 criticalEPSS 0.43%ConfluenceJira
CVE-2026-67214 nanoid Infinite Loop via Negative Size in non-secure module
CVSS 5.9 mediumEPSS 0.33%ConfluenceJira
CVSS 6.5 mediumEPSS 0.43%Confluence
CVSS 7.5 highEPSS 0.44%Confluence
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)