Known vulnerabilities in Bitbucket Data Center

Vendor: Atlassian
Software: Bitbucket Data Center
Software CPE: cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*
Website: https://www.atlassian.com
Total vulnerabilities: 121
Public exploits: 18
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Bitbucket Data Center Bitbucket Data Center is affected by 121 known vulnerabilities: 17 high, 92 medium, 12 low Critical High Medium Low

Vulnerabilities (121)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139385 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-46625		 CWE-1321 Medium
No
No
 9.4.22, 10.2.5, 10.3.2 26.07.2026 SB2026072610
SB2026072615
SB2026072616
#VU139383 - Improper Authentication
CVE-2026-47838		 CWE-287 Low
No
No
 9.4.7, 10.2.5, 10.3.2 26.07.2026 SB2026072608
SB2026072615
SB2026072621
#VU139083 - Interpretation Conflict
CVE-2026-6322		 CWE-436 Medium
No
No
 9.4.22, 10.2.0, 10.3.0 22.07.2026 SB2026072227
SB2026072231
SB2026072232
and 12 more
#VU139082 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-6321		 CWE-22 Medium
No
No
 9.4.22, 10.2.0, 10.3.0 22.07.2026 SB2026072227
SB2026072228
SB2026072229
and 11 more
#VU133441 - Missing Release of Resource after Effective Lifetime
CVE-2026-48043		 CWE-772 Medium
No
No
 9.4.22, 10.2.5, 10.3.2 08.06.2026 SB2026060813
SB20260626101
SB2026070933
and 3 more
#VU133099 - Allocation of Resources Without Limits or Throttling
CVE-2026-44488		 CWE-770 Medium
No
No
 9.4.21, 10.2.4, 10.3.1 31.05.2026 SB2026052927
SB2026061992
SB2026070157
and 8 more
#VU133098 - Insertion of Sensitive Information Into Sent Data
CVE-2026-44487		 CWE-201 Low
No
No
 9.4.21, 10.2.4, 10.3.1 31.05.2026 SB2026052927
SB2026061992
SB2026070157
and 9 more
#VU133097 - Exposure of sensitive information to an unauthorized actor
CVE-2026-44486		 CWE-200 Medium
No
No
 9.4.21, 10.2.4, 10.3.1 31.05.2026 SB2026052927
SB2026061992
SB2026070157
and 6 more
#VU133096 - Inefficient Regular Expression Complexity
CVE-2026-44496		 CWE-1333 Medium
No
No
 9.4.21, 10.2.4, 10.3.1 31.05.2026 SB2026052927
SB2026061992
SB2026070157
and 6 more
#VU132949 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-44495		 CWE-1321 Medium
No
No
 9.4.21, 10.2.4, 10.3.1 29.05.2026 SB20260424169
SB2026061999
SB20260619101
and 10 more
#VU132756 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-44490		 CWE-1321 Medium
Available
No
 9.4.21, 10.2.4, 10.3.1 29.05.2026 SB2026052927
SB2026071542
SB2026072613
and 3 more
#VU132755 - Server-Side Request Forgery (SSRF)
CVE-2026-44492		 CWE-918 Medium
Available
No
 9.4.21, 10.2.4, 10.3.1 29.05.2026 SB2026052927
SB2026061992
SB2026070157
and 6 more
#VU132750 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-44494		 CWE-1321 High
Available
No
 9.4.21, 10.2.4, 10.3.1 29.05.2026 SB2026052927
SB2026070157
SB2026070202
and 10 more
#VU131249 - Use of Uninitialized Resource
CVE-2026-45736		 CWE-908 Low
No
No
 9.4.22, 10.2.5, 10.3.1 12.05.2026 SB20260512113
SB2026061995
SB2026062221
and 9 more
#VU130210 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-42585		 CWE-444 Medium
No
No
 9.4.22, 10.2.4, 10.3.1 05.05.2026 SB20260505124
SB2026052040
SB20260528254
and 13 more
#VU128374 - Improper Access Control
CVE-2026-22731		 CWE-284 High
No
No
 10.2.4, 10.3.1 28.04.2026 SB20260428205
SB2026061632
SB2026062914
and 1 more
#VU127595 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-42041		 CWE-1321 Medium
No
No
 9.4.21, 10.2.4, 10.3.1 24.04.2026 SB20260424169
SB2026061954
SB2026062221
and 8 more
#VU124423 - Allocation of Resources Without Limits or Throttling
CVE-2026-33871		 CWE-770 Medium
No
No
 9.4.22, 10.2.4, 10.3.1 25.03.2026 SB2026032533
SB20260415180
SB20260422237
and 15 more
#VU72013 - UNIX Symbolic Link (Symlink) Following
CVE-2022-1537		 CWE-61 Low
No
No
 10.3.2 07.02.2023 SB2023020752
SB2023020757
SB2026072615
#VU51945 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-23358		 CWE-94 High
No
No
 10.3.2 06.04.2021 SB2021040623
SB2021040624
SB2021050609
and 20 more


Showing elements 1 - 20 out of 121