# Atlassian Crucible


- [CVE-2026-21589](https://insights.sbomify.com/CVE-2026-21589/): Atlassian Multiple Products Files or Directories Accessible to External Parties (critical 9.3, exploited in the wild)
- [CVE-2022-26136](https://insights.sbomify.com/CVE-2022-26136/): Auth bypass in Bamboo Data Center (critical 9.8)
- [CVE-2021-43958](https://insights.sbomify.com/CVE-2021-43958/): Security feature bypass in Crucible (critical 9.8)
- [CVE-2017-16861](https://insights.sbomify.com/CVE-2017-16861/): Code injection in Fisheye and Crucible (critical 9.8)
- [CVE-2012-2926](https://insights.sbomify.com/CVE-2012-2926/): XML external entity in n/a (critical 9.1)
- [CVE-2017-14591](https://insights.sbomify.com/CVE-2017-14591/): Command injection in Fisheye and Crucible (critical 9.0)
- [CVE-2022-26137](https://insights.sbomify.com/CVE-2022-26137/): Security feature bypass in Bamboo Data Center (high 8.8)
- [CVE-2020-4018](https://insights.sbomify.com/CVE-2020-4018/): Cross-site request forgery in Crucible (high 8.8)
- [CVE-2018-13399](https://insights.sbomify.com/CVE-2018-13399/): Privilege escalation in Fisheye and Crucible (high 7.8)
- [CVE-2021-43957](https://insights.sbomify.com/CVE-2021-43957/): Path traversal in Crucible (high 7.5)
- [CVE-2020-14190](https://insights.sbomify.com/CVE-2020-14190/): Denial of service in Crucible (high 7.5)
- [CVE-2020-14191](https://insights.sbomify.com/CVE-2020-14191/): Denial of service in Crucible (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/products/atlassian/crucible/