DeutschShown in its original language — a full translation is planned for a future version.
Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen
view advisory published 2026-07-21
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (67)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-21579US | high7.5 | — | ||
This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data… | ||||
| CVE-2026-21577US | medium6.5 | — | ||
This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center.… | ||||
| CVE-2026-21575US | high8.0 | — | ||
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.
This RCE (Remote Code Execution)… | ||||
| CVE-2026-48779US | — | — | ||
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0… | ||||
| CVE-2026-12143US | — | — | ||
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concate… | ||||
| CVE-2026-50010US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrust… | ||||
| CVE-2026-48043US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDeco… | ||||
| CVE-2026-45416US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the… | ||||
| CVE-2026-44249US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass… | ||||
| CVE-2026-44705US | high8.2 | — | ||
tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary d… | ||||
| CVE-2026-44496US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the… | ||||
| CVE-2026-44495US | high7.7 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing.… | ||||
| CVE-2026-44494US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows… | ||||
| CVE-2026-44492US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 addre… | ||||
| CVE-2026-44490US | high8.2 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is poll… | ||||
| CVE-2026-44488US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were… | ||||
| CVE-2026-44487US | high7.5 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected… | ||||
| CVE-2026-44486US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affecte… | ||||
| CVE-2026-46625US | — | — | ||
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assign… | ||||
| CVE-2026-47838US | high8.1 | — | ||
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully… | ||||
showing 20 of 67
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-21286 vom 2026-07-28external
- Red Hat Security Advisory RHSA-2026:36625 vom 2026-08-13external
- Red Hat Security Advisory RHSA-2026:44263 vom 2026-07-28external
- Red Hat Security Advisory RHSA-2026:44267 vom 2026-07-28external
- Red Hat Security Advisory RHSA-2026:46885 vom 2026-07-27external
- Red Hat Security Advisory RHSA-2026:46903 vom 2026-07-27external
- Red Hat Security Advisory RHSA-2026:47388 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:47451 vom 2026-07-29external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan