Known vulnerabilities in Bamboo Server

Vendor: Atlassian
Software: Bamboo Server
Software CPE: cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*
Total vulnerabilities: 64
Public exploits: 9
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Bamboo Server Bamboo Server is affected by 64 known vulnerabilities: 1 critical, 4 high, 53 medium, 6 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU128313 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-41044
CWE-94 Medium
No
No
10.2.20, 12.1.8 28.04.2026 SB2026042852
SB2026050348
SB2026050349
and 5 more
#VU123020 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-66021
CWE-79 Low
No
No
10.2.14, 12.1.2 18.02.2026 SB2026021830
SB2026021863
SB2026040913
#VU121703 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-12383
CWE-362 Medium
No
No
9.6.21, 10.2.13 20.01.2026 SB2026012071
SB2026012079
SB20260120119
and 17 more
#VU118877 - Resource exhaustion
CVE-2025-64775
CWE-400 Medium
No
No
9.6.21, 10.2.13, 12.1.0 01.12.2025 SB2025120157
SB2026012180
SB2026021948
and 4 more
#VU114385 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-54988
CWE-611 Medium
Available
No
9.6.20, 10.2.12, 12.0.2 22.08.2025 SB2025082219
SB2025083007
SB2025083008
and 31 more
#VU114026 - Resource exhaustion
CVE-2025-55163
CWE-400 Medium
No
No
9.6.19, 10.2.8 13.08.2025 SB2025081378
SB2025081948
SB2025081949
and 71 more
#VU114024 - Resource exhaustion
CVE-2025-48989
CWE-400 Medium
No
No
9.6.17, 10.2.8, 11.0.5 13.08.2025 SB2025081375
SB2025081376
SB20250820127
and 49 more
#VU112276 - Resource exhaustion
CVE-2025-53506
CWE-400 Medium
No
No
9.6.16, 10.2.7, 11.0.4 04.07.2025 SB20250704167
SB2025072535
SB2025072536
and 41 more
#VU112275 - Resource Management Errors
CVE-2025-52520
CWE-399 Medium
No
No
9.6.16, 10.2.7, 11.0.4 04.07.2025 SB20250704167
SB2025072535
SB2025072536
and 42 more
#VU112274 - Improper input validation
CVE-2025-52434
CWE-20 Medium
No
No
9.6.16, 10.2.8 04.07.2025 SB20250704167
SB2025072535
SB2025072536
and 32 more
#VU112166 - Improper Authentication
CVE-2025-49146
CWE-287 High
No
No
10.2.6, 11.0.3 04.07.2025 SB2025070405
SB2025070406
SB2025070708
and 13 more
#VU111165 - Improper Access Control
CVE-2025-48734
CWE-284 Medium
No
No
9.6.15, 10.2.6, 11.0.3 16.06.2025 SB2025061643
SB2025061644
SB2025061645
and 141 more
#VU111162 - Resource exhaustion
CVE-2025-48976
CWE-400 Medium
Available
No
9.6.15, 10.2.6, 11.0.3 16.06.2025 SB2025061634
SB2025061635
SB2025061927
and 156 more
#VU109240 - Configuration
CVE-2025-27820
CWE-16 Medium
No
No
10.2.6, 11.0.3 16.05.2025 SB2025051604
SB2025060628
SB2025063009
and 10 more
#VU108837 - Improper Resource Shutdown or Release
CVE-2024-13009
CWE-404 Medium
No
No
9.6.15 09.05.2025 SB2025050925
SB2025052987
SB2025060616
and 22 more
#VU107996 - Error Handling
CVE-2025-31650
CWE-388 Medium
Available
No
9.6.13, 10.2.4, 11.0.1 28.04.2025 SB2025042851
SB2025050943
SB2025050982
and 38 more
#VU106926 - Resource Management Errors
CVE-2024-57699
CWE-399 Medium
No
No
9.6.11, 10.2.3 03.04.2025 SB2025040317
SB2025040325
SB2025040326
and 63 more
#VU105881 - Security Features
CVE-2025-22228
CWE-254 Low
No
No
9.6.14, 10.2.3 19.03.2025 SB2025031966
SB2025040327
SB2025061733
and 24 more
#VU105452 - Server-Side Request Forgery (SSRF)
CVE-2025-27152
CWE-918 Medium
Available
No
9.6.20, 10.2.12, 11.0.8 07.03.2025 SB2025030777
SB2025031918
SB2025032417
and 42 more
#VU103770 - Improper input validation
CVE-2025-24970
CWE-20 Medium
No
No
9.6.11, 10.2.2 11.02.2025 SB2025021186
SB202502197190
SB2025030409
and 88 more


Showing elements 1 - 20 out of 64