OOWASP ModSecurity

Products

Exploited and recent CVEs

• CVE-2026-104269 High 8.6 ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java) 0.6%
• CVE-2026-73856 High 8.6 ModSecurity: Response Body Inspection Bypass 0.6%
• CVE-2026-61813 Low 3.7 ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download 0.2%
• CVE-2026-103932 Medium 5.8 ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match 0.3%
• CVE-2026-52747 High 8.6 ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass 0.5%
• CVE-2026-52761 Medium 5.8 ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture 0.4%
• CVE-2026-42268 High 8.2 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators 0.4%
• CVE-2026-30923 High 8.2 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings 0.4%
• CVE-2025-54571 Medium 6.9 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure 0.3%
• CVE-2025-52891 Medium 6.5 ModSecurity empty XML tag causes segmentation fault 0.4%
• CVE-2025-48866 High 7.5 ModSecurity has possible DoS vulnerability in sanitiseArg action 0.9%
• CVE-2025-47947 High 7.5 ModSecurity Has Possible DoS Vulnerability 0.6%
• CVE-2025-27110 High 7.9 Libmodsecurity3 has possible bypass of encoded HTML entities 0.5%
• CVE-2024-1019 High 8.6 WAF bypass of the ModSecurity v3 release line 0.7%