OWASP vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 20251
3. 20262

Newest CVEs

• CVE-2026-16764

  OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

  OWASP · DefectDojo

  Medium5.3
• CVE-2026-3816

  OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service

  OWASP · DefectDojo

  Medium5.3
• CVE-2025-66021

  OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

  OWASP · java-html-sanitizer

  High8.6
• CVE-2021-4247

  OWASP NodeGoat Query Parameter research.js denial of service

  OWASP · NodeGoat

  Medium4.3
• CVE-2022-39958

  Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

  OWASP · ModSecurity Core Rule Set

  High7.5
• CVE-2022-39957

  Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

  OWASP · ModSecurity Core Rule Set

  High7.3
• CVE-2022-39956

  Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

  OWASP · ModSecurity Core Rule Set

  High7.3
• CVE-2022-39955

  Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

  OWASP · ModSecurity Core Rule Set

  High7.3