Known vulnerabilities in Bitbucket Server

Vendor: Atlassian
Software CPE: cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 82
Public exploits: 13
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Bitbucket Server Bitbucket Server is affected by 82 known vulnerabilities: 1 critical, 11 high, 64 medium, 6 low Critical High Medium Low

Vulnerabilities (82)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118654 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2020-28471
CWE-1321 Medium
No
No
8.19.25 20.11.2025 SB2022072566
SB2025112081
#VU117681 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-55752
CWE-22 High
Available
No
8.19.26, 9.4.15, 10.1.1 27.10.2025 SB2025102748
SB20251031122
SB20251031123
and 43 more
#VU115573 - Protection Mechanism Failure
CVE-2025-41249
CWE-693 Medium
No
No
8.19.26, 9.4.15, 10.0.1 16.09.2025 SB20250916314
SB2025100741
SB20251008143
and 62 more
#VU114026 - Resource exhaustion
CVE-2025-55163
CWE-400 Medium
No
No
9.4.13, 10.0.2 13.08.2025 SB2025081378
SB2025081948
SB2025081949
and 71 more
#VU114024 - Resource exhaustion
CVE-2025-48989
CWE-400 Medium
No
No
8.19.26, 9.4.15, 10.1.1 13.08.2025 SB2025081375
SB2025081376
SB20250820127
and 49 more
#VU112106 - Memory corruption
CVE-2025-52999
CWE-119 Medium
No
No
8.19.26, 9.4.15 02.07.2025 SB2025070257
SB2025070261
SB2025070262
and 43 more
#VU111165 - Improper Access Control
CVE-2025-48734
CWE-284 Medium
No
No
8.19.25, 9.4.13 16.06.2025 SB2025061643
SB2025061644
SB2025061645
and 141 more
#VU100921 - Incorrect Regular Expression
CVE-2024-21538
CWE-185 Medium
No
No
8.19.16, 9.4.4 26.11.2024 SB2024112627
SB2024112629
SB2024120325
and 67 more
#VU97652 - Resource exhaustion
CVE-2024-38286
CWE-400 Medium
No
No
8.19.26 23.09.2024 SB2024092355
SB2024100267
SB2024102808
and 26 more
#VU97574 - Uncontrolled Recursion
CVE-2024-7254
CWE-674 Medium
No
No
8.19.25 19.09.2024 SB2024091904
SB2024100103
SB2024101050
and 90 more
#VU97244 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-38999
CWE-1321 High
No
No
8.19.25 13.09.2024 SB2024091339
SB2024091626
SB20241015165
and 13 more
#VU97208 - Asymmetric Resource Consumption (Amplification)
CVE-2024-45590
CWE-405 Medium
Available
No
8.19.25 12.09.2024 SB2024091249
SB2024091251
SB2024091252
and 59 more
#VU95816 - Server-Side Request Forgery (SSRF)
CVE-2024-29415
CWE-918 Medium
Available
No
8.19.25 13.08.2024 SB2024081345
SB2024082612
SB2024082760
and 14 more
#VU87615 - Resource exhaustion
CVE-2023-52428
CWE-400 Medium
No
No
8.19.25 19.03.2024 SB2024031924
SB2024040107
SB2024041643
and 43 more
#VU86944 - Server-Side Request Forgery (SSRF)
CVE-2023-42282
CWE-918 Medium
No
No
8.19.25 01.03.2024 SB2024030127
SB2024030148
SB2024030415
and 29 more
#VU86624 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2024-25710
CWE-835 Medium
No
No
8.19.25 20.02.2024 SB2024022033
SB2024022937
SB2024031520
and 102 more
#VU83234 - Incorrect Comparison
CVE-2023-45133
CWE-697 Low
No
No
8.19.25 17.11.2023 SB2023111710
SB2023111712
SB2023113028
and 24 more
#VU78932 - Incorrect Regular Expression
CVE-2022-25883
CWE-185 Medium
No
No
9.4.17, 10.1.5, 10.2.0 03.08.2023 SB2023080361
SB2023080362
SB2023081514
and 73 more
#VU76601 - Deserialization of Untrusted Data
CVE-2016-1000027
CWE-502 High
No
No
8.19.25 29.05.2023 SB2023052915
SB2023060816
SB2023062703
and 24 more
#VU76185 - Incorrect Regular Expression
CVE-2021-3803
CWE-185 Medium
No
No
8.19.25 16.05.2023 SB2021091716
SB2023051651
SB2023053029
and 12 more


Showing elements 1 - 20 out of 82