In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.2. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A broken authentication and session management vulnerability in Atlassian Crowd. (CVE-2026-21582)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-45416, CVE-2026-55831, CVE-2026-55833, CVE-2026-48043, CVE-2026-56819)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-42041, CVE-2026-44490, CVE-2026-42035, CVE-2026-42033)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-67320, CVE-2026-44487, CVE-2026-44486)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- Multiple insecure deserialization vulnerabilities in the bundled jackson-databind dependency. (CVE-2026-54513, CVE-2026-54512)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- Multiple denial of service vulnerabilities in the bundled Spring Framework dependency. (CVE-2026-41842, CVE-2026-41851, CVE-2026-41850)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- Multiple denial of service vulnerabilities in the bundled Micrometer dependency. (CVE-2026-40983, CVE-2026-40984)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.24 or 10.4.x prior to 11.3.10. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A remote code execution vulnerability in the bundled @babel/traverse dependency. (CVE-2023-45133)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A broken authentication and session management vulnerability in Atlassian Jira. (CVE-2026-21582)

- A file inclusion vulnerability in the bundled rollup dependency. (CVE-2026-27606)

- An injection vulnerability in the bundled axios dependency. (CVE-2026-44494)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-59901, CVE-2026-56745, CVE-2026-55833, CVE-2026-56819, CVE-2026-45416, CVE-2026-48043, CVE-2026-42587, CVE-2026-55831, CVE-2026-42583)

- A denial of service vulnerability in the bundled react-router dependency. (CVE-2026-55685)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A server-side request forgery (SSRF) vulnerability in the bundled ip-address dependency. (CVE-2026-69192)

- A denial of service vulnerability in the bundled brace-expansion dependency. (CVE-2026-13149)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- A denial of service vulnerability in the bundled undici dependency. (CVE-2026-12151)

- An injection vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-24734)

- A denial of service vulnerability in the bundled Spring Framework dependency. (CVE-2026-41842)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-44488)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.23 or 9.3.x prior to 10.2.15. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- An injection vulnerability in the bundled minimist dependency. (CVE-2021-44906)

- A security misconfiguration vulnerability in the bundled Bouncy Castle dependency. (CVE-2025-14813)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A man-in-the-middle vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-53434)

- Multiple denial of service vulnerabilities in the bundled linkify-it dependency. (CVE-2026-48801, CVE-2026-59887)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A file inclusion vulnerability in the bundled node-tar dependency. (CVE-2026-29786)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- A denial of service vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-42198)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-25639)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a
    denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through
    1.15.11. (CVE-2026-40983)

ID	Name	Product	Family	Type	Severity
115706	Atlassian Crowd < 7.2.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115700	Atlassian Jira 10.4.x < 11.3.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115699	Atlassian Jira < 10.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115692	Atlassian Confluence 9.3.x < 10.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115691	Atlassian Confluence < 9.2.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
445787	SCA: security update for io.micrometer:micrometer-core (GHSA-w737-wx49-qj23)	Tenable Cloud Security	SCA Checks	Local	high
445787	SCA: security update for io.micrometer:micrometer-core (GHSA-w737-wx49-qj23)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-40983

high

Tenable Plugins

high

critical

critical

critical

critical

high

high