Vulnerabilities

TI-2026-85491 CVE-2026-104269

ModSecurity misreads RFC 2231 filename* values, bypassing WAF rules

LOW 38

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00569 Published 2026-11-05 Partial fix · 3.0.17 CWE-436

TI-2026-85489 CVE-2026-73856

ModSecurity Response Body Inspection Bypass via Mixed-Case Content-Type

LOW 38

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00565 Published 2026-11-05 Fixed in 3.0.17 CWE-178

TI-2026-85487 CVE-2026-61813

Incorrect TLS hostname verification in ModSecurity HTTPS client

LOW 17

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00155 Published 2026-11-05 Partial fix · 2.9.15, 3.0.17 CWE-295

TI-2026-85486 CVE-2026-103932

ModSecurity PCRE2 @rxGlobal turns match-limit errors into no-match

LOW 26

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00321 Published 2026-11-05 Fixed in 3.0.17 CWE-253

TI-2026-13953 CVE-2026-16764 · GHSA-43fx-4mqw-qphw

OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

LOW 24

A vulnerability was identified in OWASP DefectDojo 2.59.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-23 Fixed in 2.58.3, 3.0.0 CWE-266

TI-2026-37865 CVE-2026-52747

ModSecurity: Multipart form-data parser silently strips embedded line breaks from…

HIGH 76

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00476 Published 2026-07-10 Partial fix · 3.0.16 CWE-180

TI-2026-37879 CVE-2026-52761

ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture

LOW 32

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00411 Published 2026-07-10 Partial fix · 3.0.16 CWE-467

TI-2026-30581 CVE-2026-42268

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

HIGH 75

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00396 Published 2026-05-12 Partial fix · 3.0.15 CWE-191

TI-2026-23748 CVE-2026-30923

libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

HIGH 75

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00435 Published 2026-05-05 Fixed in 3.0.15 CWE-125

TI-2026-29093 CVE-2026-40316

OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow

HIGH 73

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00411 Published 2026-04-15 No fix listed CWE-94

TI-2026-26071 CVE-2026-33691

OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

LOW 39

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03845 Published 2026-04-02 Fixed in 3.3.9, 4.25.0 CWE-178

TI-2026-03305 CVE-2026-3816 · GHSA-22w8-2mrr-vh7h

OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service

MEDIUM 57

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00605 Published 2026-03-09 Fixed in 2.56.0 CWE-404

TI-2026-17577 CVE-2026-21876

OWASP CRS has multipart bypass using multiple content-type parts

MEDIUM 63

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.1735 Published 2026-01-08 Fixed in 4.22.0, 3.3.8 CWE-794

TI-2025-40548 CVE-2025-66022

FACTION Unauthenticated Custom Extension Upload leads to RCE

HIGH 76

FACTION is a PenTesting Report Generation and Collaboration Framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00717 Published 2025-11-26 Fixed in 1.7.1 CWE-287

TI-2025-40547 CVE-2025-66021 · GHSA-g9gq-3pfx-2gw2

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

HIGH 72

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00289 Published 2025-11-26 Partial fix · 20260101.1 CWE-79

TI-2025-34348 CVE-2025-54571

ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

HIGH 70

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00349 Published 2025-08-05 Partial fix · 2.9.12 CWE-252

TI-2025-32927 CVE-2025-52891

ModSecurity empty XML tag causes segmentation fault

LOW 29

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00382 Published 2025-07-02 Fixed in 2.9.11 CWE-20

TI-2025-31022 CVE-2025-48866

ModSecurity has possible DoS vulnerability in sanitiseArg action

HIGH 72

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00867 Published 2025-06-02 Partial fix · 2.9.10 CWE-1050

TI-2025-30340 CVE-2025-47947

ModSecurity Has Possible DoS Vulnerability

HIGH 72

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00599 Published 2025-05-21 Fixed CWE-1050

TI-2025-19980 CVE-2025-27110

Libmodsecurity3 has possible bypass of encoded HTML entities

HIGH 74

Libmodsecurity is one component of the ModSecurity v3 project.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00485 Published 2025-02-25 No fix listed CWE-172

TI-2023-26060 CVE-2023-48171 · GHSA-wpgr-jvp4-g62h

An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate…

MEDIUM 41

An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00627 Published 2024-08-12 No fix listed CWE-269

TI-2024-00942 CVE-2024-1019 · GHSA-w56r-g989-xqw3

WAF bypass of the ModSecurity v3 release line

MEDIUM 44

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00688 Published 2024-01-30 No fix listed CWE-20

TI-2024-15704 CVE-2024-23686 · GHSA-frxm-v7q3-v2wv

DependencyCheck Debug Mode Logging of NVD API Key

MEDIUM 57

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00603 Published 2024-01-19 Fixed in 9.0.6 CWE-532

TI-2023-19686 CVE-2023-38285 · GHSA-wf6m-89q7-h9jh

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.

MEDIUM 41

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00898 Published 2023-07-26 No fix listed CWE-407

TI-2023-19612 CVE-2023-38199 · GHSA-662c-vg67-m327

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple…

MEDIUM 50

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00748 Published 2023-07-13 No fix listed CWE-843

Vulnerabilities

Filters