How many Atlassian Confluence Server CVEs are in CISA KEV?

Yes — 9 of Atlassian Confluence Server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Atlassian Confluence Server are affected?

420 distinct Atlassian Confluence Server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Atlassian Confluence Server CVEs?

Atlassian Confluence Server's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize).

How many critical Atlassian Confluence Server vulnerabilities are there?

Atlassian Confluence Server has 11 critical and 22 high-severity CVEs.

What is the average severity of Atlassian Confluence Server CVEs?

The average CVSS base score across Atlassian Confluence Server's scored CVEs is 7.6.

Atlassian Confluence Server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Atlassian Confluence Server vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Atlassian Confluence Server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

Atlassian Confluence Server has 53 published CVE records since 2012, of which 9 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Atlassian Confluence Server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of Atlassian Confluence Server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical11

High22

Medium20

Low0

In CISA’s Known Exploited Vulnerabilities catalog

9 of Atlassian Confluence Server's CVEs are confirmed exploited in the wild.

Public exploits

15 of Atlassian Confluence Server's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Atlassian Confluence Server version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

>= 8.0.06 CVEs
>= 8.2.05 CVEs
>= 8.3.05 CVEs
>= 8.4.05 CVEs
>= 8.5.05 CVEs
>= 8.1.04 CVEs
>= 8.6.04 CVEs
>= 7.19.03 CVEs
>= 8.7.13 CVEs
>= 7.20.02 CVEs
>= 8.5.12 CVEs
7.20.0 to 7.20.32 CVEs

Common weakness types

The CWE weakness categories most often found in Atlassian Confluence Server CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Atlassian Confluence Server CVEs were published each year.

2012

2014

2017

2019

2020

2021

2022

Other Atlassian products

Browse vulnerabilities for other products by Atlassian.

Jira Server160 CVEs Jira156 CVEs Jira Data Center104 CVEs crucible53 CVEs fisheye53 CVEs Confluence Data Center45 CVEs jira software data center45 CVEs data center39 CVEs

Frequently asked questions

Common questions about Atlassian Confluence Server vulnerabilities.

How many CVEs does Atlassian Confluence Server have?: Atlassian Confluence Server has 53 published CVE records since 2012.
How many Atlassian Confluence Server CVEs are in CISA KEV?: Yes — 9 of Atlassian Confluence Server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Atlassian Confluence Server vulnerabilities?: Yes — 15 of Atlassian Confluence Server's CVEs have a known public exploit.
Which versions of Atlassian Confluence Server are affected?: 420 distinct Atlassian Confluence Server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Atlassian Confluence Server CVEs?: Atlassian Confluence Server's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize).
How many critical Atlassian Confluence Server vulnerabilities are there?: Atlassian Confluence Server has 11 critical and 22 high-severity CVEs.
What is the average severity of Atlassian Confluence Server CVEs?: The average CVSS base score across Atlassian Confluence Server's scored CVEs is 7.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Atlassian Confluence Server vulnerabilities

Monitor new Atlassian Confluence Server vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

Version ranges

>= 7.5.011 CVEs
>= 6.14.06 CVEs
7.19 <= v < 7.19.184 CVEs
8.5.0 <= v < 8.5.54 CVEs
8.7.0 <= v <= 8.7.24 CVEs
< 7.13.73 CVEs
< 7.14.33 CVEs
< 7.15.23 CVEs
< 7.16.43 CVEs
< 7.17.43 CVEs
< 7.4.173 CVEs
< 8.0.03 CVEs
>= 6.7.03 CVEs
>= 7.14.03 CVEs
>= 7.15.03 CVEs
>= 7.16.03 CVEs
>= 7.17.03 CVEs
>= 7.18.03 CVEs
>= 7.19.183 CVEs
>= 8.5.53 CVEs
7.14.0 <= v < 7.14.33 CVEs
7.15.0 <= v < 7.15.23 CVEs
7.16.0 <= v < 7.16.43 CVEs
7.17.0 <= v < 7.17.43 CVEs
7.18.0 <= v <= 7.18.03 CVEs
7.20.0 <= v <= 7.20.33 CVEs
8.0.0 <= v <= 8.0.43 CVEs
8.1.0 <= v <= 8.1.43 CVEs
8.2.0 <= v <= 8.2.33 CVEs
8.3.0 <= v <= 8.3.43 CVEs
8.4.0 <= v <= 8.4.53 CVEs
< 6.13.232 CVEs
< 7.11.02 CVEs
< 7.11.62 CVEs
< 7.12.32 CVEs
< 7.12.52 CVEs
< 7.19.02 CVEs
< 7.2.02 CVEs
< 7.4.102 CVEs
< 7.4.112 CVEs
< 7.4.52 CVEs
>= 6.1.02 CVEs
>= 7.12.02 CVEs
>= 8.5.42 CVEs
>= 8.6.02 CVEs
6.13.0 <= v < 6.13.32 CVEs
6.14.0 <= v < 6.14.22 CVEs
6.14.0 <= v < 7.4.112 CVEs
7.12.0 <= v < 7.12.52 CVEs
7.20.0 <= v < 8.2.02 CVEs
7.5.0 <= v < 7.11.62 CVEs
7.5.0 <= v < 7.12.32 CVEs
7.5.0 <= v < 7.13.72 CVEs
8.6.0 <= v <= 8.6.22 CVEs
< 1.0.01 CVE
< 1.1.21 CVE
< 4.0.01 CVE
< 5.6.01 CVE
< 5.8.61 CVE
< 6.1.01 CVE
< 6.12.31 CVE
< 6.13.11 CVE
< 6.13.101 CVE
< 6.13.181 CVE
< 6.13.31 CVE
< 6.13.71 CVE
< 6.14.21 CVE
< 6.15.101 CVE
< 6.15.21 CVE
< 6.15.51 CVE
< 6.15.81 CVE
< 6.6.121 CVE
< 6.6.161 CVE
< 6.6.71 CVE
< 6.8.51 CVE
< 6.9.31 CVE
< 7.0.11 CVE
< 7.0.51 CVE
< 7.1.21 CVE
< 7.13.01 CVE
< 7.13.151 CVE
< 7.13.171 CVE
< 7.18.11 CVE
< 7.19.181 CVE
< 7.19.191 CVE
< 7.19.221 CVE
< 7.20.21 CVE
< 7.4.21 CVE
< 7.4.61 CVE
< 7.4.81 CVE
< 7.5.11 CVE
< 7.5.21 CVE
< 7.6.31 CVE
< 7.7.41 CVE
< 7.8.31 CVE
< 8.7.11 CVE
<= 6.14.31 CVE
<= 6.7.31 CVE
>= 1.0.01 CVE
>= 5.6.01 CVE
>= 6.11.01 CVE
>= 6.15.01 CVE
>= 6.8.01 CVE
>= 6.9.01 CVE
>= 7.0.11 CVE
>= 7.1.01 CVE
>= 7.13.01 CVE
>= 7.13.51 CVE
>= 7.13.71 CVE
>= 7.19.131 CVE
>= 7.19.141 CVE
>= 7.19.161 CVE
>= 7.19.171 CVE
>= 7.19.18 to 7.19.291 CVE
>= 7.19.22 to 7.19.251 CVE
>= 7.19.261 CVE
>= 7.19.71 CVE
>= 7.19.81 CVE
>= 7.19.91 CVE
>= 7.2.0-beta11 CVE
>= 7.20.21 CVE
>= 7.7.01 CVE
>= 8.0.01 CVE
>= 8.2.01 CVE
>= 8.2.21 CVE
>= 8.20.01 CVE
>= 8.3.01 CVE
>= 8.3.21 CVE
>= 8.3.31 CVE
>= 8.3.41 CVE
>= 8.4.01 CVE
>= 8.4.31 CVE
>= 8.4.41 CVE
>= 8.4.51 CVE
>= 8.5.11 CVE
>= 8.5.141 CVE
>= 8.5.21 CVE
>= 8.5.31 CVE
>= 8.5.5 to 8.5.171 CVE
>= 8.5.9 to 8.5.121 CVE
>= 8.6.11 CVE
>= 8.6.21 CVE
>= 8.7.11 CVE
>= next of 1.3.01 CVE
>= next of 6.13.01 CVE
>= next of 6.14.01 CVE
1.0 <= v < 7.19.161 CVE
1.3 <= v < 7.4.171 CVE
10.0.0 <= v < 10.0.21 CVE
2.0 <= v < 6.6.131 CVE
3.4.6 <= v <= 3.4.61 CVE
4.0 <= v < 4.0.71 CVE
4.0 <= v < 7.19.171 CVE
4.1 <= v < 4.1.101 CVE
4.1.9 <= v <= 4.1.91 CVE
5.10.0 <= v <= 5.10.01 CVE
5.10.1 <= v <= 5.10.11 CVE
5.10.2 <= v <= 5.10.21 CVE
5.10.3 <= v <= 5.10.31 CVE
5.5.0 <= v <= 5.5.01 CVE
5.6 <= v < 7.19.141 CVE
5.9.1 <= v <= 5.9.11 CVE
5.9.10 <= v <= 5.9.101 CVE
5.9.11 <= v <= 5.9.111 CVE
5.9.12 <= v <= 5.9.121 CVE
5.9.2 <= v <= 5.9.21 CVE
5.9.3 <= v <= 5.9.31 CVE
5.9.4 <= v <= 5.9.41 CVE
5.9.5 <= v <= 5.9.51 CVE
5.9.6 <= v <= 5.9.61 CVE
5.9.7 <= v <= 5.9.71 CVE
5.9.8 <= v <= 5.9.81 CVE
5.9.9 <= v <= 5.9.91 CVE
6.0.0 <= v <= 6.0.01 CVE
6.0.1 <= v <= 6.0.11 CVE
6.0.2 <= v <= 6.0.21 CVE
6.0.3 <= v <= 6.0.31 CVE
6.0.4 <= v <= 6.0.41 CVE
6.0.5 <= v <= 6.0.51 CVE
6.0.6 <= v <= 6.0.61 CVE
6.1.0 <= v < 7.13.201 CVE
6.13.0 <= v < 6.13.41 CVE
6.13.0 <= v < 7.19.201 CVE
6.13.2 <= v < 6.14.01 CVE
6.14.0 <= v < 6.14.31 CVE
6.14.0 <= v < 6.15.101 CVE
6.14.0 <= v < 6.15.81 CVE
6.14.0 <= v < 7.4.61 CVE
6.14.0 <= v <= 6.14.31 CVE
6.15.0 <= v < 6.15.21 CVE
6.15.0 <= v < 6.15.51 CVE
6.7.0 <= v < 6.12.31 CVE
6.7.0 <= v < 6.12.41 CVE
7.0.1 <= v < 7.0.51 CVE
7.1.0 <= v < 7.1.21 CVE
7.1.0 <= v <= 7.1.01 CVE
7.13.0 <= v < 7.13.71 CVE
7.14.0 <= v < 7.19.71 CVE
7.14.0 <= v < 7.19.81 CVE
7.14.0 <= v < 7.19.91 CVE
7.19 <= v < 7.19.171 CVE
7.19.0 <= v < 7.19.241 CVE
7.19.0 <= v <= 7.19.211 CVE
7.19.0 <= v <= 7.19.251 CVE
7.19.22 <= v <= 7.19.251 CVE
7.20.0 <= v < 8.2.21 CVE
7.20.0 <= v < 8.3.41 CVE
7.20.0 <= v < 8.5.51 CVE
7.20.0 <= v < 8.5.71 CVE
7.20.0 <= v < 8.5.91 CVE
7.5.0 <= v < 7.11.01 CVE
7.5.0 <= v < 7.5.11 CVE
7.5.0 <= v < 7.5.21 CVE
7.5.0 <= v < 7.6.31 CVE
7.5.0 <= v < 7.8.31 CVE
7.7.0 <= v < 7.7.41 CVE
8.0.0 <= v < 8.3.21 CVE
8.0.0 <= v < 8.3.31 CVE
8.0.0 <= v < 8.4.51 CVE
8.0.0 <= v < 8.5.11 CVE
8.0.0 <= v < 8.5.41 CVE
8.0.0 <= v < 8.5.51 CVE
8.4.0 <= v < 8.4.31 CVE
8.4.0 <= v < 8.4.41 CVE
8.5 <= v < 8.5.51 CVE
8.5.0 <= v < 8.5.111 CVE
8.5.0 <= v < 8.5.21 CVE
8.5.0 <= v < 8.5.251 CVE
8.5.0 <= v < 8.5.31 CVE
8.5.0 <= v < 8.5.41 CVE
8.5.0 <= v <= 8.5.121 CVE
8.5.0 <= v <= 8.5.81 CVE
8.5.9 <= v <= 8.5.121 CVE
8.6.0 <= v <= 8.6.01 CVE
8.7 <= v < 8.7.21 CVE
8.7.1 <= v <= 8.7.11 CVE
8.7.1 <= v <= 8.7.21 CVE
8.7.2 <= v <= 8.7.21 CVE
8.8 <= v < 8.8.01 CVE
8.8.0 <= v <= 8.8.01 CVE
8.8.0 <= v <= 8.8.11 CVE
8.8.1 <= v <= 8.8.11 CVE
8.9.0 <= v <= 8.9.21 CVE
8.9.0 <= v <= 8.9.41 CVE
9.2.0 <= v < 9.2.71 CVE