Atlassian

CPE vendor key: atlassian · 30 CVEs published in the last 24 months.

CVEs (365 d)

no change vs prior 30d

Avg CVSS (365 d)

6.73

over 21 CVEs

Avg EPSS pct (365 d)

0.26

higher = more likely exploited

KEV hit rate (365 d)

4.8%

1 of 21 added to CISA KEV

LLM-credited CVEs

none detected

Monthly CVE volume — last 24 months

Each point is one calendar month. Bars in the severity card to the right slice the same volume by CVSS band.

Severity mix

Stacked by CVSS band (Critical / High / Medium / Low) using the best available metric per CVE.

Top affected products (24 mo)

jira_align

confluence_data_center

jira_data_center

agiloft

bamboo

sourcetree

jira_server

confluence_server

crowd

bitbucket_data_center

Distinct CVEs that include each product in their CPE configuration.

Top CWEs (24 mo)

Distinct CVEs assigned each weakness.

Recent CISA KEV adds (last 12 months)

Added	CVE	Product	KEV name
2026-10-15	CVE-2026-21589	Multiple Products	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Filtered to KEV entries whose CISA vendor or product name matches this vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps that CPE-map to Microsoft).

Known exploited, all time (14)

Published	CVE
2026-10-05	CVE-2026-21589
2024-01-16	CVE-2023-22527
2023-10-31	CVE-2023-22518
2023-10-04	CVE-2023-22515
2022-08-25	CVE-2022-36804
2022-07-20	CVE-2022-26138
2022-06-03	CVE-2022-26134
2021-08-30	CVE-2021-26084
2021-08-16	CVE-2021-26086
2021-08-03	CVE-2021-26085
2019-08-09	CVE-2019-11581
2019-06-03	CVE-2019-11580
2019-04-18	CVE-2019-3398
2019-03-25	CVE-2019-3396

Attributed by CPE rather than by CISA's vendor name, so it includes CVEs filed under another vendor whose affected-product list names this one — shared library code is the usual reason. Broader, and noisier, than the name-matched card above on purpose.

Generated 16 October 2026 12:22 UTC .