Owasp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-66021 OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protHigh 8.6 · Nov 25, 2025
• CVE-2023-48171 An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.High 8.8 · Aug 12, 2024
• CVE-2023-38285 Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.High 7.5 · Jul 26, 2023
• CVE-2023-38199 coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms.Critical 9.8 · Jul 12, 2023
• CVE-2023-28882 Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in thHigh 7.5 · Apr 28, 2023
• CVE-2022-48279 In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall.High 7.5 · Jan 20, 2023
• CVE-2022-39958 The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedlyHigh 7.5 · Sep 20, 2022
• CVE-2022-39957 The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass.High 7.3 · Sep 20, 2022
• CVE-2022-39956 The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encHigh 7.3 · Sep 20, 2022
• CVE-2022-39955 The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicatHigh 7.3 · Sep 20, 2022
• CVE-2020-22669 Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.Critical 9.8 · Sep 2, 2022
• CVE-2021-42717 ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.High 7.5 · Dec 7, 2021
• CVE-2021-35368 OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.Critical 9.8 · Nov 5, 2021
• CVE-2021-42575 The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.Critical 9.8 · Oct 18, 2021
• CVE-2021-28490 In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.High 8.8 · Aug 19, 2021
• CVE-2021-23900 OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.High 7.5 · Jan 13, 2021
• CVE-2021-23899 OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.Critical 9.8 · Jan 13, 2021
• CVE-2020-15598 Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.High 7.5 · Oct 6, 2020
• CVE-2019-19886 Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming High 7.5 · Jan 21, 2020
• CVE-2018-16384 A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special funHigh 7.5 · Sep 2, 2018
• CVE-2018-12036 OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.High 7.8 · Jun 7, 2018