MO
Product
ModSecurity
10
CVEs
0
On KEV
8.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 3Low 0
Watch
Add ModSecurity to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-52747 | 8.6 | Jul 10 | ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass Affected: < 3.0.16 |
| CVE-2024-1019 | 8.6 | Jan 30 | WAF bypass of the ModSecurity v3 release line Affected: 3.0.0 through 3.0.11 |
| CVE-2026-42268 | 7.5 | May 12 | ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators Affected: >= 3.0.0, < 3.0.15 |
| CVE-2026-30923 | 7.5 | May 5 | libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings Affected: < 3.0.15 |
| CVE-2025-48866 | 7.5 | Jun 2 | ModSecurity has possible DoS vulnerability in sanitiseArg action Affected: < 2.9.10 |
| CVE-2025-47947 | 7.5 | May 21 | ModSecurity Has Possible DoS Vulnerability Affected: <= 2.9.8 |
| CVE-2025-27110 | 7.5 | Feb 25 | Libmodsecurity3 has possible bypass of encoded HTML entities Affected: = 3.0.13 |
| CVE-2025-52891 | 6.5 | Jul 2 | ModSecurity empty XML tag causes segmentation fault Affected: >= 2.9.8, < 2.9.11 |
| CVE-2025-54571 | 6.1 | Aug 5 | ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure Affected: < 2.9.12 |
| CVE-2026-52761 | 5.3 | Jul 10 | ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture Affected: >= 3.0.0, < 3.0.16 |
Showing 10