Login Request a demo
OW
Vendor
Owasp
18 products with CVEs on record
50
CVEs
0
On KEV
0
New 30D
Products
MO
Modsecurity
Owasp
8.6
15 CVEs0 on KEV0 new
OM
Owasp Modsecurity Core Rule Set
Owasp
9.8
9 CVEs0 on KEV0 new
ES
Enterprise Security Api
Owasp
9.8
4 CVEs0 on KEV0 new
DE
DefectDojo
OWASP
8.8
3 CVEs0 on KEV0 new
JS
Json-sanitizer
Owasp
9.8
3 CVEs0 on KEV0 new
DE
Dependency-check
Owasp
7.8
2 CVEs0 on KEV0 new
DE
Dependency-track
Owasp
5.4
2 CVEs0 on KEV0 new
JH
Java Html Sanitizer
Owasp
9.8
2 CVEs0 on KEV0 new
CO
Coreruleset
Owasp
9.8
1 CVEs0 on KEV0 new
CS
Csrfguard
Owasp
8.8
1 CVEs0 on KEV0 new
DF
Dependency-track Frontend
Owasp
5.4
1 CVEs0 on KEV0 new
ES
Enterprise Security Api For Java
Owasp
5.9
1 CVEs0 on KEV0 new
FA
Faction
Owasp
9.8
1 CVEs0 on KEV0 new
NO
Nodegoat
Owasp
7.5
1 CVEs0 on KEV0 new
OB
Owasp Blt
Owasp
8.8
1 CVEs0 on KEV0 new
ST
Stinger
Owasp
–
1 CVEs0 on KEV0 new
WE
Webscarab
Owasp
–
1 CVEs0 on KEV0 new
ZA
Zed Attack Proxy
Owasp
4.0
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-16764
DE
DefectDojo
OWASP
6.3
0%
Jul 23OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
CVE-2026-52747
MO
Modsecurity
Owasp
8.6
0%
Jul 10ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
CVE-2026-52761
MO
Modsecurity
Owasp
5.3
0%
Jul 10ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture
CVE-2026-42268
MO
Modsecurity
Owasp
7.5
0%
May 12ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
CVE-2026-30923
MO
Modsecurity
Owasp
7.5
0%
May 5libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
CVE-2026-40316
OB
Owasp Blt
Owasp
8.8
0%
Apr 15OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow
CVE-2026-33691
OM
Owasp Modsecurity Core Rule Set
Owasp
7.5
4%
Apr 2OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks
CVE-2026-3816
DE
DefectDojo
OWASP
6.5
1%
Mar 9OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service
CVE-2026-21876
OM
Owasp Modsecurity Core Rule Set
Owasp
5.3
18%
Jan 8The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls
CVE-2025-66022
FA
Faction
Owasp
9.8
1%
Nov 26FACTION is a PenTesting Report Generation and Collaboration Framework
CVE-2025-66021
JH
Java Html Sanitizer
Owasp
6.1
0%
Nov 26OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS
CVE-2025-54571
MO
Modsecurity
Owasp
6.1
0%
Aug 6ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx
CVE-2025-48866
MO
Modsecurity
Owasp
7.5
1%
Jun 2ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx
CVE-2023-48171
DE
Defectdojo
Owasp
8.8
1%
Aug 12An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component
CVE-2024-1019
MO
Modsecurity
Owasp
8.6
1%
Jan 30ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs
CVE-2024-23686
DE
Dependency-check
Owasp
5.3
1%
Jan 19DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API…
CVE-2023-38285
MO
Modsecurity
Owasp
7.5
1%
Jul 26Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity
CVE-2023-38199
CO
Coreruleset
Owasp
9.8
1%
Jul 13coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms
CVE-2023-28882
MO
Modsecurity
Owasp
7.5
1%
Apr 28Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class…
CVE-2022-48279
MO
Modsecurity
Owasp
7.5
1%
Jan 20In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall
CVE-2021-4247
NO
Nodegoat
Owasp
7.5
1%
Dec 18A vulnerability has been found in OWASP NodeGoat and classified as problematic
CVE-2022-39350
DF
Dependency-track Frontend
Owasp
5.4
1%
Oct 25@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
CVE-2022-39351
DE
Dependency-track
Owasp
4.4
0%
Oct 25Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions
CVE-2022-39958
OM
Owasp Modsecurity Core Rule Set
Owasp
7.5
1%
Sep 20The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP…
CVE-2022-39957
OM
Owasp Modsecurity Core Rule Set
Owasp
7.5
1%
Sep 20The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass
CVE-2022-39956
OM
Owasp Modsecurity Core Rule Set
Owasp
9.8
1%
Sep 20The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via…
CVE-2022-39955
OM
Owasp Modsecurity Core Rule Set
Owasp
9.8
1%
Sep 20The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple…
CVE-2020-22669
OM
Owasp Modsecurity Core Rule Set
Owasp
9.8
1%
Sep 2Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability
CVE-2022-24891
ES
Enterprise Security Api
Owasp
6.1
2%
Apr 27ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library
CVE-2022-23457
ES
Enterprise Security Api
Owasp
9.8
3%
Apr 25ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library
CVE-2022-27820
ZA
Zed Attack Proxy
Owasp
4.0
1%
Mar 24OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server
CVE-2021-42717
MO
Modsecurity
Owasp
7.5
3%
Dec 7ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects
CVE-2021-35368
OM
Owasp Modsecurity Core Rule Set
Owasp
9.8
3%
Nov 5OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname
CVE-2021-42575
JH
Java Html Sanitizer
Owasp
9.8
3%
Oct 18The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements
CVE-2021-28490
CS
Csrfguard
Owasp
8.8
1%
Aug 19In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token
CVE-2010-3300
ES
Enterprise Security Api For Java
Owasp
5.9
0%
Jun 22It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks
CVE-2019-25043
MO
Modsecurity
Owasp
5.3
1%
May 6ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header
CVE-2021-23900
JS
Json-sanitizer
Owasp
7.5
2%
Jan 13OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input
CVE-2021-23899
JS
Json-sanitizer
Owasp
9.8
2%
Jan 13OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input
CVE-2020-15598
MO
Modsecurity
Owasp
7.5
3%
Oct 6Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request
CVE-2020-13973
JS
Json-sanitizer
Owasp
6.1
1%
Jun 9OWASP json-sanitizer before 1.2.1 allows XSS
CVE-2019-19886
MO
Modsecurity
Owasp
7.5
3%
Jan 21Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or…
CVE-2019-1020007
DE
Dependency-track
Owasp
5.4
1%
Jul 29Dependency-Track before 3.5.1 allows XSS
CVE-2018-16384
OM
Owasp Modsecurity Core Rule Set
Owasp
7.5
2%
Sep 3A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as…
CVE-2018-13065
MO
Modsecurity
Owasp
6.1
1%
Jul 3ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element
CVE-2018-12036
DE
Dependency-check
Owasp
7.8
2%
Jun 7OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames
CVE-2013-5960
ES
Enterprise Security Api
Owasp
–
2%
Sep 30The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist…
CVE-2013-5679
ES
Enterprise Security Api
Owasp
–
2%
Sep 30The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist…
CVE-2007-4385
ST
Stinger
Owasp
–
3%
Aug 17OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests
CVE-2006-3841
WE
Webscarab
Owasp
–
1%
Jul 25Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject…