Product by OWASP
ModSecurity
19 known vulnerabilities in ModSecurity (OWASP), 0 of them actively exploited (CISA KEV).
Key figures
19
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-42717 | ModSecurity: security vulnerability | 7.5 | |
| High | CVE-2020-15598 | ModSecurity: Denial of Service | 7.5 | |
| High | CVE-2019-19886 | ModSecurity: Denial of Service | 7.5 | |
| High | CVE-2022-48279 | ModSecurity: security vulnerability | 7.5 | |
| High | CVE-2026-52747 | Owasp-modsecurity ModSecurity: Incorrect Behavior Order: Validate Before Canonicalize | 8.6 | |
| High | CVE-2025-48866 | ModSecurity has possible DoS vulnerability in sanitiseArg action | 7.5 | |
| Medium | CVE-2018-13065 | ModSecurity: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2024-1019 | WAF bypass of the ModSecurity v3 release line | 8.6 | |
| High | CVE-2026-30923 | Owasp-modsecurity ModSecurity: Out-of-bounds Read | 7.5 | |
| High | CVE-2023-38285 | ModSecurity: security vulnerability | 7.5 | |
| High | CVE-2026-42268 | ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators | 7.5 | |
| Medium | CVE-2019-25043 | ModSecurity: security vulnerability | 5.3 | |
| High | CVE-2023-28882 | ModSecurity: Denial of Service | 7.5 | |
| Medium | CVE-2026-52761 | ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture | 5.3 | |
| Medium | CVE-2025-54571 | ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure | 6.1 | |
| High | CVE-2026-61813 | ModSecurity: security vulnerability | — | |
| High | CVE-2026-73856 | ModSecurity: security vulnerability | — | |
| High | CVE-2026-61812 | ModSecurity: security vulnerability | — | |
| High | CVE-2026-73857 | ModSecurity: security vulnerability | — |