Atlassian Security Advisories & Bulletins (Data Center / Server products)

https://confluence.atlassian.com/security/security-advisories-bulletins-1236937381.html

Added 2026-10-06: S1 candidate; first-party PSIRT for Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye, none of which had a source record; the out-of-band CVE-2026-21589 advisory (published on a Monday outside the monthly cycle) was found only through EUVD and the GitHub advisory database. Recipe verified by the main agent: `extract` the advisory page and the jira.atlassian.com/browse/<KEY> public security tickets (fix tables and WAF/Tomcat mitigations read cleanly); the index lists per-advisory hrefs and the monthly bulletins fall on the third Tuesday (next 2026-10-20) plus out-of-band standalone pages.