According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.2. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A broken authentication and session management vulnerability in Atlassian Crowd. (CVE-2026-21582)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-45416, CVE-2026-55831, CVE-2026-55833, CVE-2026-48043, CVE-2026-56819)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-42041, CVE-2026-44490, CVE-2026-42035, CVE-2026-42033)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-67320, CVE-2026-44487, CVE-2026-44486)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- Multiple insecure deserialization vulnerabilities in the bundled jackson-databind dependency. (CVE-2026-54513, CVE-2026-54512)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- Multiple denial of service vulnerabilities in the bundled Spring Framework dependency. (CVE-2026-41842, CVE-2026-41851, CVE-2026-41850)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- Multiple denial of service vulnerabilities in the bundled Micrometer dependency. (CVE-2026-40983, CVE-2026-40984)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a
    denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0
    through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11
    1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18. micrometer-
    jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
    (CVE-2026-40984)

ID	Name	Product	Family	Published	Updated	Severity
115706	Atlassian Crowd < 7.2.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/16/2026	10/16/2026	high
445786	SCA: security update for io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11, io.micrometer:micrometer-jetty12 (GHSA-g3pr-3p32-fp23)	Tenable Cloud Security	SCA Checks	8/7/2026	8/13/2026	high
463707	Echo: io.micrometer:micrometer-core: security update to 1.15.12	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
445786	SCA: security update for io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11, io.micrometer:micrometer-jetty12 (GHSA-g3pr-3p32-fp23)	Tenable Self-Hosted Container Security	SCA Checks	8/7/2026	8/13/2026	high
463707	Echo: io.micrometer:micrometer-core: security update to 1.15.12	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/5/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high