{"schema_version":1,"title":"Atlassian Temporal Server vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Atlassian Temporal Server: 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-87803, was published on 10 September 2026.","url":"https://junglewise.ai/threats/technologies/server","json_url":"https://junglewise.ai/threats/technologies/server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":13,"critical":2,"exploited":2,"last_7_days":0,"last_30_days":1,"last_90_days":4,"last_365_days":10},"latest":[{"cve":"CVE-2026-87803","cvss":7.1,"epss":0.0031,"slug":"cve-2026-87803-countly-server-dbviewer-authorization-bypass-in-aggregation","title":"Countly Server DBViewer authorization bypass in aggregation pipeline","severity":"high","exploited":false,"published_at":"2026-09-10T10:17:32.61+00:00","url":"https://junglewise.ai/threats/cve-2026-87803-countly-server-dbviewer-authorization-bypass-in-aggregation"},{"cve":"CVE-2026-69115","cvss":6.5,"epss":0.0042,"slug":"cve-2026-69115-openim-server-missing-authorization-in-admin-api-endpoints","title":"OpenIM Server missing authorization in admin API endpoints","severity":"medium","exploited":false,"published_at":"2026-08-11T19:18:42.093+00:00","url":"https://junglewise.ai/threats/cve-2026-69115-openim-server-missing-authorization-in-admin-api-endpoints"},{"cve":"CVE-2026-71959","cvss":5.8,"epss":0.0039,"slug":"cve-2026-71959-bitwarden-server-authorization-bypass-in-audit-log-collection","title":"Bitwarden Server authorization bypass in audit log collection","severity":"medium","exploited":false,"published_at":"2026-08-10T14:17:26.87+00:00","url":"https://junglewise.ai/threats/cve-2026-71959-bitwarden-server-authorization-bypass-in-audit-log-collection"},{"cve":"CVE-2026-60104","cvss":7.3,"slug":"cve-2026-60104-bitwarden-server-authorization-bypass-in-admin-request-endpoint","title":"Bitwarden Server authorization bypass in admin-request endpoint","severity":"high","exploited":false,"published_at":"2026-07-08T20:17:00.413+00:00","url":"https://junglewise.ai/threats/cve-2026-60104-bitwarden-server-authorization-bypass-in-admin-request-endpoint"},{"cve":"CVE-2026-57522","cvss":3.5,"slug":"cve-2026-57522-bitwarden-server-json-injection-in-integrationtemplateprocessor","title":"Bitwarden Server JSON injection in IntegrationTemplateProcessor","severity":"low","exploited":false,"published_at":"2026-06-25T20:17:17.377+00:00","url":"https://junglewise.ai/threats/cve-2026-57522-bitwarden-server-json-injection-in-integrationtemplateprocessor"},{"cve":"CVE-2026-57521","cvss":4.3,"slug":"cve-2026-57521-bitwarden-server-broken-access-control-in","title":"Bitwarden Server broken access control in PreviewInvoiceController","severity":"medium","exploited":false,"published_at":"2026-06-25T20:17:17.22+00:00","url":"https://junglewise.ai/threats/cve-2026-57521-bitwarden-server-broken-access-control-in"},{"cve":"CVE-2026-57520","cvss":7.1,"slug":"cve-2026-57520-bitwarden-server-privilege-escalation-in-bulk-user-removal","title":"Bitwarden Server privilege escalation in bulk user removal endpoint","severity":"high","exploited":false,"published_at":"2026-06-25T20:17:17.02+00:00","url":"https://junglewise.ai/threats/cve-2026-57520-bitwarden-server-privilege-escalation-in-bulk-user-removal"},{"cve":"CVE-2026-43638","cvss":5.4,"epss":0.0003,"slug":"cve-2026-43638-bitwarden-server-missing-authorization-in-organization-cipher","title":"Bitwarden Server missing authorization in organization cipher import","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:36.823+00:00","url":"https://junglewise.ai/threats/cve-2026-43638-bitwarden-server-missing-authorization-in-organization-cipher"},{"cvss":3.1,"slug":"paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b","title":"Paperclip approval decision attribution spoofing via client-controlled decidedByUserId","severity":"low","exploited":false,"published_at":"2026-04-16T22:48:46+00:00","url":"https://junglewise.ai/threats/paperclip-approval-decision-attribution-spoofing-via-client-controlled-e49c0d0b"},{"cvss":4,"slug":"apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad","title":"Apollo Server XS-Search bypass via browser CORS bug","severity":"medium","exploited":false,"published_at":"2026-03-26T21:53:10+00:00","url":"https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad"},{"cve":"CVE-2023-22527","cvss":10,"slug":"cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection"},{"cve":"CVE-2023-22515","cvss":10,"slug":"cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-05T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control"},{"cve":"CVE-2022-31083","cvss":3.1,"epss":0.0087,"slug":"cve-2022-31083-parse-server-authentication-bypass-in-apple-game-center-adapter","title":"Parse Server authentication bypass in Apple Game Center adapter","severity":"low","exploited":false,"published_at":"2022-06-17T22:09:09+00:00","url":"https://junglewise.ai/threats/cve-2022-31083-parse-server-authentication-bypass-in-apple-game-center-adapter"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Atlassian Confluence Data Center","slug":"confluence-data-center","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/confluence-data-center"},{"name":"Atlassian Confluence Server","slug":"confluence-server","vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/confluence-server"},{"name":"Atlassian Data Center","slug":"data-center","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/data-center"}],"technology":{"hub":true,"name":"Atlassian Temporal Server","slug":"server","vendor":{"name":"Atlassian","slug":"atlassian","url":"https://junglewise.ai/threats/vendors/atlassian"},"aliases":[],"category":"workflow-engine","homepage":"https://temporal.io/","repo_url":"https://github.com/temporalio/temporal","description":"An open-source, scalable, and reliable workflow orchestration engine for managing distributed state.","url":"https://junglewise.ai/threats/technologies/server"},"most_severe":[{"cve":"CVE-2023-22527","cvss":10,"slug":"cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection","title":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection"},{"cve":"CVE-2023-22515","cvss":10,"slug":"cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control","title":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-05T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control"},{"cve":"CVE-2026-60104","cvss":7.3,"slug":"cve-2026-60104-bitwarden-server-authorization-bypass-in-admin-request-endpoint","title":"Bitwarden Server authorization bypass in admin-request endpoint","severity":"high","exploited":false,"published_at":"2026-07-08T20:17:00.413+00:00","url":"https://junglewise.ai/threats/cve-2026-60104-bitwarden-server-authorization-bypass-in-admin-request-endpoint"},{"cve":"CVE-2026-87803","cvss":7.1,"epss":0.0031,"slug":"cve-2026-87803-countly-server-dbviewer-authorization-bypass-in-aggregation","title":"Countly Server DBViewer authorization bypass in aggregation pipeline","severity":"high","exploited":false,"published_at":"2026-09-10T10:17:32.61+00:00","url":"https://junglewise.ai/threats/cve-2026-87803-countly-server-dbviewer-authorization-bypass-in-aggregation"},{"cve":"CVE-2026-57520","cvss":7.1,"slug":"cve-2026-57520-bitwarden-server-privilege-escalation-in-bulk-user-removal","title":"Bitwarden Server privilege escalation in bulk user removal endpoint","severity":"high","exploited":false,"published_at":"2026-06-25T20:17:17.02+00:00","url":"https://junglewise.ai/threats/cve-2026-57520-bitwarden-server-privilege-escalation-in-bulk-user-removal"},{"cve":"CVE-2026-69115","cvss":6.5,"epss":0.0042,"slug":"cve-2026-69115-openim-server-missing-authorization-in-admin-api-endpoints","title":"OpenIM Server missing authorization in admin API endpoints","severity":"medium","exploited":false,"published_at":"2026-08-11T19:18:42.093+00:00","url":"https://junglewise.ai/threats/cve-2026-69115-openim-server-missing-authorization-in-admin-api-endpoints"},{"cve":"CVE-2026-71959","cvss":5.8,"epss":0.0039,"slug":"cve-2026-71959-bitwarden-server-authorization-bypass-in-audit-log-collection","title":"Bitwarden Server authorization bypass in audit log collection","severity":"medium","exploited":false,"published_at":"2026-08-10T14:17:26.87+00:00","url":"https://junglewise.ai/threats/cve-2026-71959-bitwarden-server-authorization-bypass-in-audit-log-collection"},{"cve":"CVE-2026-43638","cvss":5.4,"epss":0.0003,"slug":"cve-2026-43638-bitwarden-server-missing-authorization-in-organization-cipher","title":"Bitwarden Server missing authorization in organization cipher import","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:36.823+00:00","url":"https://junglewise.ai/threats/cve-2026-43638-bitwarden-server-missing-authorization-in-organization-cipher"},{"cve":"CVE-2026-57521","cvss":4.3,"slug":"cve-2026-57521-bitwarden-server-broken-access-control-in","title":"Bitwarden Server broken access control in PreviewInvoiceController","severity":"medium","exploited":false,"published_at":"2026-06-25T20:17:17.22+00:00","url":"https://junglewise.ai/threats/cve-2026-57521-bitwarden-server-broken-access-control-in"},{"cvss":4,"slug":"apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad","title":"Apollo Server XS-Search bypass via browser CORS bug","severity":"medium","exploited":false,"published_at":"2026-03-26T21:53:10+00:00","url":"https://junglewise.ai/threats/apollo-server-xs-search-bypass-via-browser-cors-bug-108494ad"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}