Product by OWASP
OWASP ModSecurity Core Rule Set
9 known vulnerabilities in OWASP ModSecurity Core Rule Set (OWASP), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-21876 | OWASP CRS has multipart bypass using multiple content-type parts | 9.3 | |
| High | CVE-2026-33691 | OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks | 6.8 | |
| Critical | CVE-2021-35368 | OWASP ModSecurity Core Rule Set: security vulnerability | 9.8 | |
| Critical | CVE-2020-22669 | OWASP ModSecurity Core Rule Set: SQL Injection | 9.8 | |
| High | CVE-2018-16384 | OWASP ModSecurity Core Rule Set: SQL Injection | 7.5 | |
| Critical | CVE-2022-39955 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.3 | |
| High | CVE-2022-39958 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.5 | |
| Critical | CVE-2022-39956 | OWASP ModSecurity Core Rule Set: Incorrect Authorization | 7.3 | |
| High | CVE-2022-39957 | OWASP ModSecurity Core Rule Set: Protection Mechanism Failure | 7.3 |