CVE-2026-61812

The t:htmlEntityDecode transformation in OWASP ModSecurity decodes only five named HTML entities and in v3 matches entity-name prefixes, e.g. decodes to , so payloads using other entities such as evade rules. Affects v2 2.1.0-rc7 through 2.9.14 fixed 2.9.15 and v3 3.0.0-rc1 through 3.0.16 fixed...