owasp defectdojo vulnerabilities

Latest owasp defectdojo CVEs

Newest publication first

1. CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

   Published 2026-07-23

   Medium·CVSS 5.3 EPSS 0.41%

   A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performe...

2. CVE-2026-3816 OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service

   Published 2026-03-09

   Medium·CVSS 5.3 EPSS 0.61%

   A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated re...

3. CVE-2023-48171 An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.

   Published 2024-08-12

   High·CVSS 8.8 EPSS 0.63%

   An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.