Atlassian flags 100 vulnerabilities in June security bulletin, urges patching

Even when a vendor labels an issue non-critical, engineering teams still have to decide what gets patched now, what waits, and what risk they are implicitly carrying. Atlassian’s June 16 security bulletin made that tradeoff visible: 76 high-severity vulnerabilities and 24 critical-severity third-party vulnerabilities were fixed in new product versions released over the previous month.

Atlassian said its monthly Security Bulletins are published on the third Tuesday of every month, while separate Critical Security Advisories are reserved for cases that pose immediate risk. The company said the items in the monthly bulletin are assessed as non-critical for customers, even though the volume was unusually high. It also said the vulnerabilities were discovered through its Bug Bounty program, pen-testing processes and third-party library scans, a reminder that reporting volume often reflects how much security work is being done rather than a sudden collapse in product quality.

The source of the June spike was largely upstream. Atlassian said the increase in reported issues came from externally coordinated security research and patching across widely used open-source libraries, not from a change in its own security posture. That distinction matters for teams shipping software with integrations, APIs and developer tooling, where the attack surface is shaped as much by dependencies as by first-party code. For monday.com engineers, product managers and security stakeholders, it is a familiar lesson: supply-chain exposure is part of the job, not a separate risk category.

The June tally also fits a pattern across Atlassian’s recent bulletins. In March, the company reported 21 high-severity vulnerabilities. In April, it reported 31 high-severity vulnerabilities and 7 critical-severity third-party vulnerabilities. Back in August 2025, it reported 14 high-severity vulnerabilities and 1 critical-severity vulnerability. The numbers have moved around, but the operating model has not: continuous disclosure, dependency scanning and rapid remediation have become routine work for software vendors and their customers.

That is why the practical guidance in the bulletin was straightforward: patch instances to the latest fixed versions and use the vulnerability disclosure portal to check product versions and CVEs. monday.com’s own trust materials point in the same direction, with a controlled CI/CD process that includes static code analysis, vulnerability assessment, end-to-end testing, unit testing and periodic security training for developers. Its security-scanning documentation says code and dependencies are analyzed during deployment to identify known vulnerabilities, and its trust center says the company manages the data of more than 250,000 companies worldwide. In a market where work platforms sit at the center of daily operations, security hygiene is not an add-on. It is part of the product.