CVEs for Jira

Name: Rewindex CVE index
Creator: Rewindex
License: https://creativecommons.org/licenses/by/4.0/

278 matching vulnerabilities, 5 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.

Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.

CVEs per week for Jira, last 52 weeks

Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.

2026-10-05
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
CVSS 7.5 highKEV added 2026-10-15EPSS 99.5%Bitbucket Confluence Jira
2026-10-02
CVE-2026-18036 NTRU leaks private key information by reducing secret values with a non-constant-time integer division
CVSS 8.2 highEPSS 0.28%Jira
2026-10-01
CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
CVSS 7.5 highEPSS 0.56%Confluence Jira
2026-09-28
CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options
CVSS 8.3 highEPSS 0.50%Jira
2026-09-28
CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
CVSS 8.2 highEPSS 0.46%Jira
2026-09-28
CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
CVSS 7.6 highEPSS 0.42%Jira
2026-09-28
CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
CVSS 8.2 highEPSS 0.44%Confluence Jira
2026-09-28
CVE-2026-101901 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
CVSS 8.2 highEPSS 0.54%Jira
2026-09-28
CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
CVSS 7.0 highEPSS 0.55%Jira
2026-09-18
CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
CVSS 7.5 highEPSS 0.57%Jira
2026-09-15
CVE-2026-21587
CVSS 7.1 highEPSS 0.44%Jira
2026-09-04
CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVSS 7.5 highEPSS 0.39%Jira
2026-09-02
CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize
CVSS 7.5 highEPSS 0.24%Jira
2026-09-01
CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
CVSS 7.5 highEPSS 0.54%Jira
2026-08-25
CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
CVSS 7.5 highEPSS 0.74%Confluence Jira
2026-08-25
CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases
CVSS 8.1 highEPSS 0.46%Confluence Jira
2026-08-25
CVE-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints
CVSS 8.1 highEPSS 0.43%Confluence Jira
2026-08-25
CVE-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
CVSS 7.5 highEPSS 0.68%Confluence Jira
2026-08-25
CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
CVSS 9.8 criticalEPSS 0.61%Confluence Jira
2026-08-25
CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
CVSS 8.1 highEPSS 0.40%Confluence Jira
2026-08-24
CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization
CVSS 7.5 highEPSS 0.23%Bitbucket Jira
2026-08-24
CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
CVSS 7.5 highEPSS 0.22%Bitbucket Jira
2026-08-24
CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
CVSS 7.5 highEPSS 0.22%Bitbucket Jira
2026-08-22
CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
CVSS 7.5 highEPSS 0.16%Confluence Jira
2026-08-20
CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder
CVSS 7.5 highEPSS 0.52%Bitbucket Jira
2026-08-19
CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVSS 9.1 criticalEPSS 0.32%Confluence Jira
2026-08-19
CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
CVSS 7.5 highEPSS 0.37%Jira
2026-08-18
CVE-2026-21582
CVSS 8.8 highEPSS 0.46%Bitbucket Jira
2026-08-17
CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
CVSS 6.5 mediumEPSS 0.32%Jira
2026-08-17
CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
CVSS 7.5 highEPSS 0.53%Confluence Jira
2026-08-13
CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
CVSS 7.5 highEPSS 0.53%Confluence Jira
2026-08-13
CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
CVSS 7.5 highEPSS 0.79%Bitbucket Confluence Jira
2026-08-11
CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
CVSS 7.5 highEPSS 0.66%Jira
2026-08-11
CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
CVSS 7.5 highEPSS 0.66%Jira
2026-08-11
CVE-2026-73086 nanoid: Integer Overflow or Wraparound
CVSS 7.4 highEPSS 0.30%Bitbucket Confluence Jira
2026-08-04
CVE-2026-68494 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
CVSS 8.7 highEPSS 0.46%Jira
2026-04-09
CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
CVSS 7.5 highKEV added 2026-08-04EPSS 98.5%Jira
2026-08-03
CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
CVSS 7.7 highEPSS 0.47%Jira
2026-08-03
CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
CVSS 7.5 highEPSS 0.65%Bitbucket Jira
2026-08-03
CVE-2026-13506 Lazy ASN.1 sequence forcing resets nesting-depth guard
CVSS 7.5 highEPSS 0.49%Confluence Jira
2026-08-03
CVE-2026-12860 RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path
CVSS 5.3 mediumEPSS 0.17%Confluence Jira
2026-08-03
CVE-2026-12816 IESEngine stream-mode MAC forgery via length-dependent KDF split
CVSS 7.5 highEPSS 0.18%Confluence Jira
2026-08-03
CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)
CVSS 7.5 highEPSS 0.24%Confluence Jira
2026-08-03
CVE-2026-12802 CMS AuthEnvelopedData fails to enforce tag-length on decryption
CVSS 7.5 highEPSS 0.19%Bitbucket Confluence Jira
2026-08-03
CVE-2026-14682 Possible OOM from unbounded up-front allocation on a definite-length read
CVSS 7.5 highEPSS 0.49%Bitbucket Confluence Jira
2026-08-03
CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names
CVSS 7.5 highEPSS 0.49%Confluence Jira
2026-08-03
CVE-2026-58060 HSS public-key level count unbounded, enabling huge allocation on verify
CVSS 7.5 highEPSS 0.62%Confluence Jira
2026-08-03
CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check
CVSS 7.5 highEPSS 0.28%Confluence Jira
2026-08-03
CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate
CVSS 9.1 criticalEPSS 0.36%Confluence Jira
2026-08-03
CVE-2026-59639 CMS verifySignatures returns true for SignedData with zero signers
CVSS 7.5 highEPSS 0.24%Confluence Jira

Markdown JSON