Confluence is content and team collaboration software that changes how modern teams work. Confluence is the wiki for today's modern team, giving every project and person their own space to create and share. When knowledge flows freely, ideas grow and teams evolve. Confluence offers a flexible and customizable platform that grows with you, so you can collaborate your way.

Confluence Server

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server.

This Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21

 Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center and Server from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Bug Bounty program.

CVE-2026-21580

Linux

Linux Kernel

Windows

Windows Cumulative Update

VulnCheck NVD++

Docker is a set of platform-as-a-service products that use OS-level virtualization to deliver software in packages called containers.

Docker

Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application's services. Then, with a single command, you create and start all the services from your configuration. Compose works in all environments: production, staging, development, testing, as well as CI workflows.

Docker Compose

Podman is an open-source project that is available on most Linux platforms and resides on GitHub. Podman is a daemonless container engine for developing, managing, and running Open Container Initiative (OCI) containers and container images on your Linux system. Podman provides a Docker-compatible command line front end that can simply alias the Docker CLI, `alias docker=podman`.

Podman

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Wolfi

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

Docker Desktop is an application for MacOS and Windows machines, aimed at developers and system administrators. It enables them to build and share containerized applications and microservices. Docker Desktop includes Docker Engine, Docker CLI, Docker Compose, and is fully integrated with the machine’s filesystem and networking.

Docker Desktop

Kubescape CLI is an open-source Kubernetes security platform that helps identify and fix misconfigurations in Kubernetes clusters. It scans Kubernetes YAML files, Helm charts, and live clusters against various security frameworks and best practices. Kubescape CLI provides detailed risk scoring, compliance reports, and remediation suggestions to improve the security posture of Kubernetes environments.

Kubescape CLI

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Linux openSUSE

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

CVE-2026-17106

Debian

Debian Security Tracker

GoLang

GitHub Advisory Database

Minimus

Ubuntu

Ubuntu Security Tracker

Keycloak is an open-source software product that allows single sign-on with identity and access management aimed at modern applications and services.

Keycloak

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

>**Wiz Threat Research note:** 
>The maintainers of Keycloak have confirmed that this vulnerability is not limited to Red Hat builds, as the vulnerable code sits upstream. We have therefore added detection for all affected versions of Keycloak regardless of distribution (we will finetune this detection if new information comes to light that contradicts this).

CVE-2026-18963

NixOS is a Linux distribution built on top of the Nix package manager. It is completely declarative, its system configurations are reproducible, makes configuration changes reliable and atomic, and eliminates configuration drift.

NixOS

MLflow is an open-source platform designed to manage the complete machine learning lifecycle. It provides tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. MLflow integrates with a wide variety of ML libraries and simplifies the process of developing and deploying ML applications.

MLflow

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

CVE-2026-64849

Python Packaging Advisory Database

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.

CVE-2026-47698

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
CVE-2026-21580	CRITICAL	9.3	Confluence Server	cpe:2.3:a:atlassian:confluence_server	No	No	Aug 18, 2026
CVE-2026-17106	HIGH	7.1	Docker	cpe:2.3:a:docker:docker	No	Sí	Aug 18, 2026
CVE-2026-18963	CRITICAL	9.1	Keycloak	cpe:2.3:a:keycloak:keycloak	No	Sí	Aug 18, 2026
CVE-2026-64849	CRITICAL	9.3	NixOS	mlflow	Sí	Sí	Aug 17, 2026
CVE-2026-47698	CRITICAL	9.8	JavaScript	n8n	No	Sí	Aug 17, 2026

CVE ID	Severidad	Puntuación	Tecnologías	Nombre del componente	Exploit de CISA KEV	Tiene arreglo	Fecha de publicación
CVE-2026-78333	NONE	N/A	WordPress	12-step-meeting-list	No	Sí	Aug 27, 2026
CVE-2026-78139	NONE	N/A	WordPress	woocommerce-product-stock-alert	No	Sí	Aug 27, 2026
CVE-2026-78138	NONE	N/A	WordPress	finale-woocommerce-sales-countdown-timer-discount	No	Sí	Aug 27, 2026
CVE-2026-78137	NONE	N/A	WordPress	storegrowth-sales-booster	No	Sí	Aug 27, 2026
CVE-2026-78125	NONE	N/A	WordPress	learnpress-sepay-payment	No	Sí	Aug 27, 2026

Base de datos de vulnerabilidades de Wiz

Explorar por tecnología

Filtros populares

Alto perfil

Último

Vulnerabilidades en cifras

Lo bueno, lo malo y lo vulnerable

Recursos adicionales de Wiz

¿Listo para ver a Wiz en acción?