Vendor
OWASP
54 known vulnerabilities in products by OWASP, 0 of them actively exploited (CISA KEV).
Key figures
54
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-21876 | OWASP CRS has multipart bypass using multiple content-type parts | 9.3 | |
| High | CVE-2026-33691 | OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks | 6.8 | |
| Critical | CVE-2021-42575 | OWASP Java Html Sanitizer: security vulnerability | 9.8 | |
| Critical | CVE-2021-35368 | OWASP ModSecurity Core Rule Set: security vulnerability | 9.8 | |
| Critical | CVE-2021-23899 | OWASP Json-sanitizer: security vulnerability | 9.8 | |
| High | CVE-2021-42717 | ModSecurity: security vulnerability | 7.5 | |
| Critical | CVE-2022-23457 | Path Traversal in ESAPI | 7.5 | |
| High | CVE-2020-15598 | ModSecurity: Denial of Service | 7.5 | |
| High | CVE-2019-19886 | ModSecurity: Denial of Service | 7.5 | |
| Critical | CVE-2020-22669 | OWASP ModSecurity Core Rule Set: SQL Injection | 9.8 | |
| High | CVE-2021-23900 | OWASP Json-sanitizer: Denial of Service | 7.5 | |
| High | CVE-2018-12036 | OWASP Dependency-Check: Path Traversal | 7.8 | |
| High | CVE-2018-16384 | OWASP ModSecurity Core Rule Set: SQL Injection | 7.5 | |
| Critical | CVE-2025-66022 | FACTION Unauthenticated Custom Extension Upload leads to RCE | 9.7 | |
| Critical | CVE-2022-39955 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.3 | |
| High | CVE-2026-52747 | Owasp-modsecurity ModSecurity: Incorrect Behavior Order: Validate Before Canonicalize | 8.6 | |
| High | CVE-2022-39958 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.5 | |
| Critical | CVE-2023-38199 | OWASP Coreruleset: Type Confusion | 9.8 | |
| High | CVE-2022-48279 | ModSecurity: security vulnerability | 7.5 | |
| Medium | CVE-2022-24891 | Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file | 5.4 | |
| Critical | CVE-2022-39956 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.3 | |
| High | CVE-2025-48866 | ModSecurity has possible DoS vulnerability in sanitiseArg action | 7.5 | |
| Medium | CVE-2018-13065 | ModSecurity: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-40316 | OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow | 8.8 | |
| High | CVE-2023-48171 | OWASP DefectDojo: Privilege Escalation | 8.8 |