Skip to content

Vendor

owasp vulnerabilities

48 published CVES affecting owasp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
48
Critical
9
High
21
Medium
16
Low
2
Unscored
0
CISA KEV
0
Atom feed of owasp alerts

Products

Latest owasp CVEs

Newest publication first · page 1 of 2

  9. CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts

    Published
    MediumCVSS 5.3 EPSS 17.3%

    The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain...

  10. CVE-2025-66022 FACTION Unauthenticated Custom Extension Upload leads to RCE

    Published
    CriticalCVSS 9.8 EPSS 0.72%

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, result...

  13. CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action

    Published
    HighCVSS 7.5 EPSS 0.86%

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg (and sanitizeArg - this is the same act...

  15. CVE-2024-1019 WAF bypass of the ModSecurity v3 release line

    Published
    HighCVSS 8.6 EPSS 0.69%

    ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional qu...

  18. CVE-2023-38199 coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted paylo...

    Published
    CriticalCVSS 9.8 EPSS 0.75%

    coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. Th...

  20. CVE-2022-48279 In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be cons...

    Published
    HighCVSS 7.5 EPSS 1.2%

    In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

  21. CVE-2021-4247 OWASP NodeGoat Query Parameter research.js denial of service

    Published
    HighCVSS 7.5 EPSS 1.1%

    A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.