Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
58
Vulnerability1 · 1 read
CVE-2026-58062
- CVSS 4.0
- 9.3 critical
- EPSS
- <1%p27
- Published
- ·
- Modified
Description · NVD
In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
- Vendors
- bouncycastle
- Products
- bc-java, bouncy castle for java lts, fips java api
- Weakness
- CWE-295
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
In the news
2 storiesAtlassian October bulletin covers 75 third-party product CVEs
Six unique flaws are rated critical, but Atlassian assesses non-critical customer risk and cites no exploitation.
52