Owasp vulnerabilities

Products

• Modsecurity 15
• Modsecurity Core Rule Set 9
• Enterprise Security Api 4
• Modsecurity Core Rule Set 4
• Defectdojo 3
• Json-sanitizer 3
• Dependency-check 2
• Dependency-track 2
• Java Html Sanitizer 2

Newest

• owap defectdojo OWASP DefectDojo API/Web serializers.py UserSerializer privileges management CVE-2026-16764 Public exploit 5.3 MediumJuly 23, 2026
• owasp modsecurity ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass CVE-2026-52747 Fix available 8.6 HighJuly 10, 2026
• owasp modsecurity ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture CVE-2026-52761 Fix available 5.8 MediumJuly 10, 2026
• owasp modsecurity ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVE-2026-42268 Fix available 8.2 HighMay 8, 2026
• owasp modsecurity libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVE-2026-30923 Fix available 8.2 HighMay 5, 2026
• owasp blt OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow CVE-2026-40316 8.8 HighApril 15, 2026
• coreruleset, owasp modsecurity core rule set +1 more OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks CVE-2026-33691 Fix available 6.8 MediumApril 2, 2026
• owap defectdojo OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service CVE-2026-3816 5.3 MediumMarch 9, 2026
• coreruleset, owasp modsecurity core rule set +1 more OWASP CRS has multipart bypass using multiple content-type parts CVE-2026-21876 Public exploitFix available EPSS 17.7% 9.3 CriticalJanuary 8, 2026
• factionsecurity faction FACTION Unauthenticated Custom Extension Upload leads to RCE CVE-2025-66022 9.7 CriticalNovember 26, 2025
• owasp java html sanitizer, java-html-sanitizer +1 more OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization CVE-2025-66021 Fix available 8.6 HighNovember 25, 2025
• owasp modsecurity ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure CVE-2025-54571 Fix available 6.9 MediumAugust 5, 2025
• owasp modsecurity ModSecurity has possible DoS vulnerability in sanitiseArg action CVE-2025-48866 Fix available 7.5 HighJune 2, 2025
• owasp defectdojo An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via... CVE-2023-48171 8.8 HighAugust 12, 2024
• owasp modsecurity WAF bypass of the ModSecurity v3 release line CVE-2024-1019 Fix available 8.6 HighJanuary 30, 2024
• owasp dependency-check DependencyCheck Debug Mode Logging of NVD API Key CVE-2024-23686 Fix available 5.3 MediumDecember 15, 2023
• owasp modsecurity Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. CVE-2023-38285 Fix available 7.5 HighJuly 26, 2023
• owasp coreruleset coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not block multiple Content... CVE-2023-38199 Fix available 9.8 CriticalJuly 13, 2023
• owasp modsecurity Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash... CVE-2023-28882 Fix available 7.5 HighApril 28, 2023
• owasp modsecurity, debian linux +1 more In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed... CVE-2022-48279 Fix available 7.5 HighJanuary 20, 2023
• owasp nodegoat OWASP NodeGoat Query Parameter research.js denial of service CVE-2021-4247 4.3 MediumDecember 18, 2022
• dependencytrack dependency-track Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions CVE-2022-39351 4.4 MediumOctober 25, 2022
• dependencytrack frontend, owasp dependency-track frontend +1 more @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details CVE-2022-39350 Fix available 5.4 MediumOctober 25, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range CVE-2022-39958 Fix available 7.5 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header CVE-2022-39957 Fix available 7.3 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header CVE-2022-39956 Fix available 7.3 HighSeptember 20, 2022
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header CVE-2022-39955 Fix available 7.3 HighSeptember 20, 2022
• debian linux, owasp modsecurity core rule set +1 more Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass... CVE-2020-22669 Fix available 9.8 CriticalSeptember 2, 2022
• owasp enterprise security api, esapi esapi-java-legacy, netapp active iq unified manager +2 more +4 more Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file CVE-2022-24891 Public exploitFix available 5.4 MediumApril 27, 2022
• owasp enterprise security api, netapp active iq unified manager, oncommand workflow automation +2 more +4 more Path Traversal in ESAPI CVE-2022-23457 Public exploitFix available 7.5 HighApril 25, 2022
• owasp zed attack proxy Improper Certificate Validation in OWASP ZAP CVE-2022-27820 4.0 MediumMarch 24, 2022
• owasp modsecurity, debian linux, f5 nginx modsecurity waf +2 more +4 more ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects... CVE-2021-42717 Public exploitFix available 7.5 HighDecember 7, 2021
• owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 more OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is... CVE-2021-35368 Fix available 9.8 CriticalNovember 5, 2021
• owasp java html sanitizer, oracle middleware common libraries and tools, primavera unifier +2 more Policies not properly enforced in OWASP Java HTML Sanitizer CVE-2021-42575 Fix available 9.8 CriticalOctober 18, 2021
• owasp csrfguard Cross-Site Request Forgery in OWASP CSRFGuard CVE-2021-28490 Fix available 8.8 HighAugust 19, 2021
• owasp enterprise security api for java Padding oracle attacks CVE-2010-3300 Fix available 5.9 MediumJune 22, 2021
• owasp modsecurity ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string... CVE-2019-25043 Fix available 5.3 MediumMay 6, 2021
• owasp json-sanitizer Uncaught Exception leading to Denial of Service in json-sanitizer CVE-2021-23900 Fix available 7.5 HighJanuary 13, 2021
• owasp json-sanitizer Arbitrary code injection in json-sanitizer CVE-2021-23899 Fix available 9.8 CriticalJanuary 13, 2021
• owasp modsecurity, debian linux +1 more ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special... CVE-2020-15598 Fix availableDisputed 7.5 HighSeptember 18, 2020
• owasp json-sanitizer Cross-site scripting in json-sanitizer CVE-2020-13973 Public exploitFix available 6.1 MediumJune 9, 2020
• owasp modsecurity, fedoraproject fedora +1 more Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may,... CVE-2019-19886 Fix available 7.5 HighJanuary 21, 2020
• dependency-track Dependency-Track before 3.5.1 allows XSS. CVE-2019-1020007 5.4 MediumJuly 29, 2019
• owasp modsecurity core rule set A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp... CVE-2018-16384 Fix available 7.5 HighSeptember 3, 2018
• owasp modsecurity ** DISPUTED ** ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a... CVE-2018-13065 Disputed 6.1 MediumJuly 3, 2018
• owasp dependency-check Path Traversal in OWASP Dependency-Check CVE-2018-12036 Public exploitFix available 7.8 HighJune 7, 2018
• owasp enterprise security api Missing Cryptographic Step in OWASP Enterprise Security API for Java CVE-2013-5960 Fix available 5.8 MediumSeptember 30, 2013
• owasp enterprise security api Missing Cryptographic Step in OWASP Enterprise Security API for Java CVE-2013-5679 Fix available 2.6 LowSeptember 30, 2013
• owasp stinger OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using... CVE-2007-4385 Public exploit 6.8 MediumAugust 17, 2007
• owasp webscarab Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with... CVE-2006-3841 2.6 LowJuly 25, 2006