DeutschShown in its original language — a full translation is planned for a future version.
Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen
view advisory published 2026-04-21
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (27)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-21571US | high8.8 | — | ||
This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,
11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
T… | ||||
| CVE-2026-34487US | — | — | ||
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.
This issue af… | ||||
| CVE-2026-24880US | — | Exploit | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.
This issue affects Apache Tomcat: from… | ||||
| CVE-2026-33871US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) again… | ||||
| CVE-2026-33870US | — | — | ||
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunk… | ||||
| CVE-2026-31802US | medium5.5 | Exploit | ||
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive… | ||||
| CVE-2026-29063US | critical9.8 | — | ||
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeD… | ||||
| CVE-2026-26960US | high7.1 | — | ||
node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction dire… | ||||
| CVE-2026-24734US | high7.5 | — | ||
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did n… | ||||
| CVE-2026-25639US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing co… | ||||
| CVE-2026-25547US | — | — | ||
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue cau… | ||||
| CVE-2026-24842US | — | — | ||
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actu… | ||||
| CVE-2026-23950US | medium5.9 | — | ||
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-… | ||||
| CVE-2026-23745US | medium6.1 | Exploit | ||
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default s… | ||||
| CVE-2026-22029US | medium6.1 | — | ||
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects… | ||||
| CVE-2024-29371US | — | — | ||
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression rat… | ||||
| CVE-2025-66020US | — | — | ||
Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDo… | ||||
| CVE-2025-48734US | — | Exploit | ||
Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared… | ||||
| CVE-2024-47875US | medium6.1 | Exploit | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and… | ||||
| CVE-2024-45801US | medium6.1 | — | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass th… | ||||
showing 20 of 27
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01external
- Red Hat Security Advisory RHSA-2026:10201 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10204 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10205 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10206 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10209 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10211 vom 2026-04-23external
- Red Hat Security Advisory RHSA-2026:10213 vom 2026-04-23external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan