Atlassian Jira < 9.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JRASERVER-79546)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-79546 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...

Atlassian Jira Service Management Data Center and Server < 5.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JSDSERVER-16809)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16809 advisory. - This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Da...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: تنفيذ الأوامر عن بُعد في Bitbucket RCE تحليل تقني واستغلال مخبري لحقن وسائط البايت الفارغ Null-Byte Argument Injection ملخص الثغرة الأمنية CVE-2022-36804 هي ثغرة حقن وسائط Argument Injection بدرجة خطورة عالية/حرجة ضمن REST API الخاصة بخوادم Atlassian Bitbucket Server وData Center...

sonarcloud-scan

أنبوب Bitbucket Pipelines: فحص SonarQube Cloud افحص كودك باستخدام SonarQube Cloud لاكتشاف الأخطاء البرمجية والثغرات الأمنية وروائح الكود في أكثر من 25 لغة برمجة. يجب أولاً ربط حساب SonarCloud الخاص بك بفريق Bitbucket أو حساب المستخدم الخاص بك. SonarQube Cloud مجاني تمامًا للمشاريع مفتوحة المصدر...

bitbucket-test

Conteneur Docker pour enquêter sur CVE-2022-36804 Recréation d'une vulnérabilité d'exécution de code à distance où Bitbucket ne parvient pas à assainir les entrées utilisateur, ce qui permet aux attaquants d'injecter des options Git et d'exécuter du code à distance. Ce dépôt documente comment j'a...

bitbucket-iac-scan

Bitbucket Security: Infrastructure as Code Security Scanner Scans your Infrastructure as Code configuration files to ensure good security practises. Creates a security Code Insights report if issue is found. This Bitbucket Cloud supported Pipe leverages the industry leading KICS scanning tool to...

PT-2026-106255

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center versions prior to 9.4.26, 10.2.8, and 10.5.1 Confluence Data Center versions prior to 9.2.26 and 10.2.19 Crowd Data Center versions prior to 6.3.7, 7.0.3, 7.1.7, and 7.2.4 Jira Software Data Center versions prior to...

automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-84717

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-84717 Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

EUVD-2026-85612

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-84717 Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

CVE-2026-84717

A flaw in the Ansible Automation Platform automation-controller allows an unauthenticated remote attacker to enumerate Job Template and Workflow Job Template IDs that have Bitbucket Data Center webhooks configured. The vulnerability exists because the unauthenticated Bitbucket Data Center webhook...

CVE-2026-84717

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

PT-2026-97545

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description An unauthenticated remote attacker can enumerate Job Template and Workflow Job Template IDs that have Bitbucket Data Center webhooks configured. This...

SUSE CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...