Owasp
9 CVEs tracked since 2013. Since Sep 2013, none of them reached CISA KEV.
Owasp CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2013-09 | 2 | 0 |
| 2013-10 | null or fewer | |
| 2013-11 | null or fewer | |
| 2013-12 | null or fewer | |
| 2014-01 | null or fewer | |
| 2014-02 | null or fewer | |
| 2014-03 | null or fewer | |
| 2014-04 | null or fewer | |
| 2014-05 | null or fewer | |
| 2014-06 | null or fewer | |
| 2014-07 | null or fewer | |
| 2014-08 | null or fewer | |
| 2014-09 | null or fewer | |
| 2014-10 | null or fewer | |
| 2014-11 | null or fewer | |
| 2014-12 | null or fewer | |
| 2015-01 | null or fewer | |
| 2015-02 | null or fewer | |
| 2015-03 | null or fewer | |
| 2015-04 | null or fewer | |
| 2015-05 | null or fewer | |
| 2015-06 | null or fewer | |
| 2015-07 | null or fewer | |
| 2015-08 | null or fewer | |
| 2015-09 | null or fewer | |
| 2015-10 | null or fewer | |
| 2015-11 | null or fewer | |
| 2015-12 | null or fewer | |
| 2016-01 | null or fewer | |
| 2016-02 | null or fewer | |
| 2016-03 | null or fewer | |
| 2016-04 | null or fewer | |
| 2016-05 | null or fewer | |
| 2016-06 | null or fewer | |
| 2016-07 | null or fewer | |
| 2016-08 | null or fewer | |
| 2016-09 | null or fewer | |
| 2016-10 | null or fewer | |
| 2016-11 | null or fewer | |
| 2016-12 | null or fewer | |
| 2017-01 | null or fewer | |
| 2017-02 | null or fewer | |
| 2017-03 | null or fewer | |
| 2017-04 | null or fewer | |
| 2017-05 | null or fewer | |
| 2017-06 | null or fewer | |
| 2017-07 | null or fewer | |
| 2017-08 | null or fewer | |
| 2017-09 | null or fewer | |
| 2017-10 | null or fewer | |
| 2017-11 | null or fewer | |
| 2017-12 | null or fewer | |
| 2018-01 | null or fewer | |
| 2018-02 | null or fewer | |
| 2018-03 | null or fewer | |
| 2018-04 | null or fewer | |
| 2018-05 | null or fewer | |
| 2018-06 | null or fewer | |
| 2018-07 | null or fewer | |
| 2018-08 | null or fewer | |
| 2018-09 | null or fewer | |
| 2018-10 | null or fewer | |
| 2018-11 | null or fewer | |
| 2018-12 | null or fewer | |
| 2019-01 | null or fewer | |
| 2019-02 | null or fewer | |
| 2019-03 | null or fewer | |
| 2019-04 | null or fewer | |
| 2019-05 | null or fewer | |
| 2019-06 | null or fewer | |
| 2019-07 | null or fewer | |
| 2019-08 | null or fewer | |
| 2019-09 | null or fewer | |
| 2019-10 | null or fewer | |
| 2019-11 | null or fewer | |
| 2019-12 | null or fewer | |
| 2020-01 | null or fewer | |
| 2020-02 | null or fewer | |
| 2020-03 | null or fewer | |
| 2020-04 | null or fewer | |
| 2020-05 | null or fewer | |
| 2020-06 | null or fewer | |
| 2020-07 | null or fewer | |
| 2020-08 | null or fewer | |
| 2020-09 | null or fewer | |
| 2020-10 | null or fewer | |
| 2020-11 | null or fewer | |
| 2020-12 | null or fewer | |
| 2021-01 | 2 | 0 |
| 2021-02 | null or fewer | |
| 2021-03 | null or fewer | |
| 2021-04 | null or fewer | |
| 2021-05 | null or fewer | |
| 2021-06 | null or fewer | |
| 2021-07 | null or fewer | |
| 2021-08 | null or fewer | |
| 2021-09 | null or fewer | |
| 2021-10 | null or fewer | |
| 2021-11 | null or fewer | |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | null or fewer | |
| 2022-06 | null or fewer | |
| 2022-07 | null or fewer | |
| 2022-08 | null or fewer | |
| 2022-09 | 5 | 0 |
Products
The products that kept showing up in Owasp's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Owasp.
- CVE-2026-16764OWASP DefectDojo API/Web serializers.py UserSerializer privileges management6.3
- CVE-2026-52761ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture5.8
- CVE-2026-42268ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators7.5
- CVE-2026-30923libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings7.5
- CVE-2026-40316OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow8.8
- CVE-2026-33691OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks6.8
- CVE-2026-3816OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service4.3
- CVE-2026-21876OWASP CRS has multipart bypass using multiple content-type parts9.3
- CVE-2025-66022FACTION Unauthenticated Custom Extension Upload leads to RCE9.6
- CVE-2025-66021OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization6.1
- CVE-2025-54571ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure6.1
- CVE-2025-48866ModSecurity has possible DoS vulnerability in sanitiseArg action7.5
- CVE-2023-48171An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.8.8
- CVE-2024-1019WAF bypass of the ModSecurity v3 release line8.6
- CVE-2024-23686DependencyCheck Debug Mode Logging of NVD API Key5.3
The record
- Peak rank
- #48 in Sep 2013
- Busiest month shown
- Sep 2022, 5 CVEs
- Months with a KEV entry
- 0 since Sep 2013
- Monthly snapshots
- 3 since 2013