OWASP

Products

Exploited and recent CVEs

• CVE-2026-16764 Medium 6.3 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management 0.4%
• CVE-2026-3816 Medium 4.3 OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service 0.6%
• CVE-2025-66021 High 8.6 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization 0.3%
• CVE-2021-4247 Medium 4.3 OWASP NodeGoat Query Parameter research.js denial of service 1.1%
• CVE-2022-39958 High 7.5 Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range 1.2%
• CVE-2022-39956 High 7.3 Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header 1.2%
• CVE-2022-39955 High 7.3 Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header 1.4%
• CVE-2022-39957 High 7.3 Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header 1.0%