CO
Vendor
corazawaf
12
CVEs
0
On KEV
12
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114101 | CO coraza corazawaf | 4.0 | Oct 21 | Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass |
| CVE-2026-114100 | CO coraza corazawaf | 5.8 | Oct 21 | Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type |
| CVE-2026-114099 | CO coraza corazawaf | 5.8 | Oct 21 | Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision |
| CVE-2026-41508 | CO coraza corazawaf | 5.8 | Oct 12 | OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling |
| CVE-2026-41504 | CO coraza corazawaf | 5.8 | Oct 12 | OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields |
| CVE-2026-104774 | CO coraza corazawaf | 5.8 | Oct 12 | OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass |
| CVE-2026-41510 | CO coraza corazawaf | 7.2 | Oct 12 | OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding |
| CVE-2026-107835 | CO coraza corazawaf | 4.0 | Oct 9 | OWASP Coraza WAF: Cookie Parser Confusion |
| CVE-2026-107834 | CO coraza corazawaf | 5.3 | Oct 9 | OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor |
| CVE-2026-107833 | CO coraza corazawaf | 5.9 | Oct 9 | OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion |
| CVE-2026-107826 | CO coraza corazawaf | 7.5 | Oct 9 | OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) |
| CVE-2026-107825 | CO coraza corazawaf | 4.0 | Oct 9 | OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations |