Linux Distros Unpatched Vulnerability : CVE-2026-103932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None Ubuntu Linux - GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash...

Linux Distros Unpatched Vulnerability : CVE-2026-104259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment...

[SECURITY] Fedora 45 Update: libmodsecurity-3.0.17-2.fc45

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. In general, it provides the capability to load/interpret rules written in the ModSecurity...

Exploit for Excessive Platform Resource Consumption within a Loop in Trustwave Modsecurity

THIS IS A POC FOR LAST YEAR CVE INVOLVING modsecurity & libapa...

xss_db

RUBY RUBY는 웹 요청의 공격 가능성을 탐지하고, 위험도와 정책에 따라 대응 전략을 선택해 방어 기법을...

Linux Distros Unpatched Vulnerability : CVE-2026-61813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching ove...

Linux Distros Unpatched Vulnerability : CVE-2026-73857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None Ubuntu Linux - GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-73856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None Ubuntu Linux - GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing CVE-2026-73856 Note...

PT-2026-104002

Name of the Vulnerable Software and Affected Versions libmodsecurity3 versions prior to 3.0.17 mod security2 versions prior to 2.9.15 Description A response body inspection bypass occurs due to non-canonical casing in the Content-Type header. Additionally, a flaw exists that can lead to a crash...

Linux Distros Unpatched Vulnerability : CVE-2026-61812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion CVE-2026-61812...

sentinel

Sentinel · Security Operations & Management Console Lightwe...

Astra Linux – Vulnerability in ModSecurity-Apache

ModSecurity is an open-source, cross-platform web application firewall WAF engine for Apache, IIS, and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which can lead to various issues depending on the HTTP scenario. For example, we have demonstrated...

owasp-modsecurity-crs-4.29.0-1.1 on GA media (moderate)

owasp-modsecurity-crs-4.29.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11632-1 Rating: moderate Cross-References: CVE-2026-33691 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:11632-1 owasp-modsecurity-crs-4.29.0-1.1 on GA media

These are all security issues fixed in the owasp-modsecurity-crs-4.29.0-1.1 package on the GA media of openSUSE Tumbleweed...

coreruleset v4.29.0

Branch| Status ---|--- main| 🛡️ OWASP CRS The OWASP CRS is a set of generic attack detection rules for use with OWASP ModSecurity, OWASP Coraza, or other compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a...

[SECURITY] Fedora 43 Update: nginx-mod-modsecurity-1.0.4-16.fc43

The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...

Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-3b93aae2d6)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b93aae2d6 advisory. nginx-mod-vts: - Rebuild for 1.30.4 nginx-mod-brotli: - Rebuild for 1.30.4 nginx-mod-fancyindex: - Rebuild for 1.30.4 nginx-mod-headers-more: -...

[SECURITY] Fedora 44 Update: nginx-mod-modsecurity-1.0.4-16.fc44

The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...

EUVD-2026-45032

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @loginrequired, including POST...

CVE-2026-61718 bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @loginrequired, including POST...