Owasp
17 CVEs across 20 Owasp products. Browse Owasp vulnerabilities, severities, and proof-of-concept exploits.
Owasp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16764 | Medium | 6.3 | 2026-07-23 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the compone… |
CVE-2026-52761 | Medium | 5.8 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode t… |
CVE-2026-52747 | High | 8.6 | 2026-07-10 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request… |
CVE-2026-42268 | High | 7.5 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandl… |
CVE-2026-30923 | High | 7.5 | 2026-05-05 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecuri… |
CVE-2026-40316 | High | 8.8 | 2026-04-15 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an… |
CVE-2026-33691 | Medium | 6.8 | 2026-04-02 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0… |
CVE-2026-3816 | Medium | 4.3 | 2026-03-09 | A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of th… |
CVE-2026-21876 | Critical | 9.3 | 2026-01-08 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8… |
CVE-2025-66022 | Critical | 9.6 | 2025-11-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework per… |
CVE-2025-66021 | Medium | 6.1 | 2025-11-26 | OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while pro… |
CVE-2025-54571 | Medium | 6.1 | 2025-08-06 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can ov… |
CVE-2025-48866 | High | 7.5 | 2025-06-02 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of ser… |
CVE-2023-48171 | High | 8.8 | 2024-08-12 | An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component. |
CVE-2024-1019 | High | 8.6 | 2024-01-30 | ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 d… |
CVE-2024-23686 | Medium | 5.3 | 2024-01-19 | DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to r… |
CVE-2023-38285 | High | 7.5 | 2023-07-26 | Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. |
CVE-2023-38199 | Critical | 9.8 | 2023-07-13 | coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attac… |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2021-4247 | Medium | 4.3 | 2022-12-18 | A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of t… |
CVE-2022-39351 | Medium | 4.4 | 2022-10-25 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, p… |
CVE-2022-39350 | Medium | 5.4 | 2022-10-25 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to… |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2020-22669 | Critical | 9.8 | 2022-09-02 | Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable… |
CVE-2022-24891 | Medium | 5.4 | 2022-04-27 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for… |
CVE-2022-23457 | High | 7.5 | 2022-04-25 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementatio… |
CVE-2022-27820 | Medium | 4.0 | 2022-03-24 | OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server. |
CVE-2021-42717 | High | 7.5 | 2021-12-07 | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web serv… |
CVE-2021-35368 | Critical | 9.8 | 2021-11-05 | OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname. |
CVE-2021-42575 | Critical | 9.8 | 2021-10-18 | The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements. |
CVE-2021-28490 | High | 8.8 | 2021-08-19 | In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token. |
CVE-2010-3300 | Medium | 5.9 | 2021-06-22 | It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks. |
CVE-2019-25043 | Medium | 5.3 | 2021-05-06 | ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie… |
CVE-2021-23900 | High | 7.5 | 2021-01-13 | OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the applica… |
CVE-2021-23899 | Critical | 9.8 | 2021-01-13 | OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML… |
CVE-2020-15598 | High | 7.5 | 2020-10-06 | Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing… |
CVE-2020-13973 | Medium | 6.1 | 2020-06-09 | OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT eleme… |
CVE-2019-19886 | High | 7.5 | 2020-01-21 | Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming… |
CVE-2019-1020007 | Medium | 5.4 | 2019-07-29 | Dependency-Track before 3.5.1 allows XSS. |
CVE-2018-16384 | High | 7.5 | 2018-09-03 | A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special fu… |
CVE-2018-13065 | Medium | 6.1 | 2018-07-03 | ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments wit… |
CVE-2018-12036 | High | 7.8 | 2018-06-07 | OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames. |
CVE-2013-5960 | | 2013-09-30 | The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does n… | |
CVE-2013-5679 | | 2013-09-30 | The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not… | |
CVE-2007-4385 | | 2007-08-17 | OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests… | |
CVE-2006-3841 | | 2006-07-25 | Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote… |