Atlassian Confluence Server vulnerabilities

CVEs per yearBy the year they were published

1. 20171
2. 20191
3. 20206
4. 20223
5. 20225
6. 20227
7. 20246
8. 20249
9. 20261

Known exploitedNewest addition to KEV first

• CVE-2023-22527

  A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…

  Atlassian · Confluence Data Center

  ExploitedCritical10.0
• CVE-2023-22518

  All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…

  Atlassian · Confluence Data Center

  ExploitedCritical10.0
• CVE-2023-22515

  Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in…

  Atlassian · Confluence Data Center

  ExploitedCritical10.0
• CVE-2022-26134

  In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…

  Atlassian · Confluence Data Center

  ExploitedCritical9.8
• CVE-2021-26085

  Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability…

  Atlassian · Confluence Server

  ExploitedMedium5.3
• CVE-2021-26084

  In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute…

  Atlassian · Confluence Server

  ExploitedCritical9.8
• CVE-2019-3396

  The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed…

  Atlassian · Confluence Server

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-21580

  This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0,…

  Atlassian · Confluence Data Center

  High8.6
• CVE-2023-22512

  This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this…

  Atlassian · Confluence Data Center

  High7.5
• CVE-2024-21703

  This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations.…

  Atlassian · Confluence Data Center

  Medium6.4
• CVE-2024-21690

  This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0,…

  Atlassian · Confluence Data Center

  High7.1
• CVE-2024-21686

  This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS…

  Atlassian · Confluence Data Center

  High7.3
• CVE-2024-21673

  This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution…

  Atlassian · Confluence Data Center

  High8.0
• CVE-2024-21672

  This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE)…

  Atlassian · Confluence Data Center

  High8.3
• CVE-2023-22527

  A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…

  Atlassian · Confluence Data Center

  ExploitedCritical10.0
• CVE-2024-21674

  This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE)…

  Atlassian · Confluence Data Center

  High8.6
• CVE-2023-22522

  This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence…

  Atlassian · Confluence Data Center

  Critical9.0