Atlassian
- Exploited flaws
- 14in 10 products
- Added to CISA's list in 2026
- 10 in 2025
- Used by ransomware
- 8of 14, says CISA
- Disclosure to CISA's list
- 10 daysmedian; 5 of 9 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2019 | 4 |
| 2020 | 0 |
| 2021 | 3 |
| 2022 | 3 |
| 2023 | 3 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 1 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Confluence Data Center and Server | 3 | 2023-10-05 | 2024-01-24 |
| Confluence Server and Data Center | 2 | 2021-11-03 | 2021-11-03 |
| Jira Server and Data Center | 2 | 2022-03-07 | 2024-11-12 |
Latest on CISA's list
- Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- Atlassian Jira Server and Data Center Path Traversal Vulnerability
- Atlassian Confluence Data Center and Server Template Injection Vulnerability
- Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
- Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
- Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
- Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
- Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
- Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
- Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
In the news
No security story in the last 14 days named Atlassian in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.