CVE-2026-33691

< 3.3.9

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior

6.8MEDIUM

CVE-2026-21876

< 3.3.8

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior

9.3CRITICAL

CVE-2022-39958

>= 3.0.0 and < 3.2.2

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable

7.5HIGH

CVE-2022-39957

>= 3.0.0 and < 3.2.2

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field co

7.3HIGH

CVE-2022-39956

>= 3.0.0 and < 3.2.2

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a pay

7.3HIGH

CVE-2022-39955

>= 3.0.0 and < 3.2.2

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-

7.3HIGH

CVE-2020-22669

all versions

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the co

9.8CRITICAL

CVE-2021-35368

>= 3.1.0 and < 3.1.2

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypas

9.8CRITICAL

CVE-2019-13464

all versions

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PH

7.5HIGH

CVE-2019-11391

<= 3.1.0

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf all

5.3MEDIUM

CVE-2019-11390

<= 3.1.0

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf all

5.3MEDIUM

CVE-2019-11389

<= 3.1.0

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf all

5.3MEDIUM

CVE-2019-11388

<= 3.1.0

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf all

5.3MEDIUM

CVE-2019-11387

>= 3.0.0 and <= 3.1.0

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf al

5.3MEDIUM

CVE-2018-16384

<= 3.0.2

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {

7.5HIGH