According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.24 or 10.4.x prior to 11.3.10. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A remote code execution vulnerability in the bundled @babel/traverse dependency. (CVE-2023-45133)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A broken authentication and session management vulnerability in Atlassian Jira. (CVE-2026-21582)

- A file inclusion vulnerability in the bundled rollup dependency. (CVE-2026-27606)

- An injection vulnerability in the bundled axios dependency. (CVE-2026-44494)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-59901, CVE-2026-56745, CVE-2026-55833, CVE-2026-56819, CVE-2026-45416, CVE-2026-48043, CVE-2026-42587, CVE-2026-55831, CVE-2026-42583)

- A denial of service vulnerability in the bundled react-router dependency. (CVE-2026-55685)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A server-side request forgery (SSRF) vulnerability in the bundled ip-address dependency. (CVE-2026-69192)

- A denial of service vulnerability in the bundled brace-expansion dependency. (CVE-2026-13149)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- A denial of service vulnerability in the bundled undici dependency. (CVE-2026-12151)

- An injection vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-24734)

- A denial of service vulnerability in the bundled Spring Framework dependency. (CVE-2026-41842)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-44488)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.2. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A broken authentication and session management vulnerability in Atlassian Crowd. (CVE-2026-21582)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-45416, CVE-2026-55831, CVE-2026-55833, CVE-2026-48043, CVE-2026-56819)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-42041, CVE-2026-44490, CVE-2026-42035, CVE-2026-42033)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-67320, CVE-2026-44487, CVE-2026-44486)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- Multiple insecure deserialization vulnerabilities in the bundled jackson-databind dependency. (CVE-2026-54513, CVE-2026-54512)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- Multiple denial of service vulnerabilities in the bundled Spring Framework dependency. (CVE-2026-41842, CVE-2026-41851, CVE-2026-41850)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- Multiple denial of service vulnerabilities in the bundled Micrometer dependency. (CVE-2026-40983, CVE-2026-40984)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values,
    which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can
    lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24;
    5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. (CVE-2026-47838)

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16652 advisory.

  - This High severity BASM (Broken Authentication & Session Management) vulnerability was introduced in versions     10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service     Management Data Center, allowing an authenticated attacker to perform actions as another user.     (CVE-2026-47838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115699	Atlassian Jira < 10.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/16/2026	10/16/2026	critical
115706	Atlassian Crowd < 7.2.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/16/2026	10/16/2026	high
115700	Atlassian Jira 10.4.x < 11.3.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/16/2026	10/16/2026	critical
444191	SCA: security update for org.springframework.security:spring-security-web (GHSA-293q-567p-wmwq)	Tenable Cloud Security	SCA Checks	7/1/2026	7/2/2026	high
460499	Echo: org.springframework.security:spring-security-web: security update to 6.5.10+echo.1	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
444191	SCA: security update for org.springframework.security:spring-security-web (GHSA-293q-567p-wmwq)	Tenable Self-Hosted Container Security	SCA Checks	7/1/2026	7/2/2026	high
460499	Echo: org.springframework.security:spring-security-web: security update to 6.5.10+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
330091	Atlassian Jira Service Management Data Center and Server 10.0.x / 10.1.1 / 10.2.x / 10.3.x < 10.3.7 / 10.4.x / 10.5.x / 10.6.x / 11.x < 11.3.8 (JSDSERVER-16652)	Nessus	Misc.	7/27/2026	7/29/2026	high

Detections

Analytics

Plugins Search

critical

high

critical

high

high

high

high

high