TI-2026-37865 CVE-2026-52747
ModSecurity: Multipart form-data parser silently strips embedded line breaks from…
Priority HIGH 76
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
owasp-modsecurity
Records57All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high26CVSS 7.0–8.9
Exploited now
owasp-modsecurity records in CISA KEVNo owasp-modsecurity vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records in Modsecurity · all components
TI-2026-30581 CVE-2026-42268
ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
Priority HIGH 75
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
TI-2026-23748 CVE-2026-30923
libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
Priority HIGH 75
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
Priority HIGH 72
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
TI-2025-34348 CVE-2025-54571
ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
Priority HIGH 70
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
TI-2024-00942 CVE-2024-1019 · GHSA-w56r-g989-xqw3
WAF bypass of the ModSecurity v3 release line
Priority MEDIUM 44
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs.
TI-2023-19686 CVE-2023-38285 · GHSA-wf6m-89q7-h9jh
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
Priority MEDIUM 41
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
TI-2022-23897 CVE-2022-48279 · GHSA-6fhx-fm6h-hpxq
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were…
Priority MEDIUM 41
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall.
TI-2023-13383 CVE-2023-28882 · GHSA-wgcm-rvmx-wh95
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker…
Priority MEDIUM 40
Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
TI-2021-18927 CVE-2021-42717 · GHSA-w3vf-7fpc-9fww
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.
Priority LOW 39
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.
TI-2020-12273 CVE-2020-15598 · GHSA-ff2c-wgr6-2p58
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.
Priority LOW 38
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.
TI-2019-14335 CVE-2019-19886 · GHSA-p5f3-2x3f-r9c7
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests…
Priority LOW 38
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw i…
TI-2026-37879 CVE-2026-52761
ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
Priority LOW 32
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
TI-2018-09372 CVE-2018-13065 · GHSA-p6wp-wgv9-7657
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element.
Priority LOW 30
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element.
TI-2019-15183 CVE-2019-25043 · GHSA-p89w-8r2h-7mjp
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a…
Priority LOW 26
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header.