Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
58
CVE-2026-65637
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p53
- Published
- ·
- Modified
Description · NVD
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
- Vendors
- apache
- Products
- tomcat
- Ecosystems
- maven
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- GHSA
- GHSA-f525-44xv-f2qj (critical)
In the news
2 storiesAtlassian October bulletin covers 75 third-party product CVEs
Six unique flaws are rated critical, but Atlassian assesses non-critical customer risk and cites no exploitation.
52