CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,345 CVEs published, 273 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,345
Show in the list
Critical, last 7 days
273
Show in the list
Healthcare-tagged, last 7 days
10
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product corazawaf:coraza. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

12 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-107825Medium 4.0OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
Assigned by GitHub_M
Oct 9, 2026
CVE-2026-107826High 7.5OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
Assigned by GitHub_M
Oct 9, 2026
CVE-2026-107833Medium 5.9OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
Assigned by GitHub_M
Oct 9, 2026
CVE-2026-107834Medium 5.3OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
Assigned by GitHub_M
Oct 9, 2026
CVE-2026-107835Medium 4.0OWASP Coraza WAF: Cookie Parser Confusion
Assigned by GitHub_M
Oct 9, 2026
CVE-2026-41510High 7.2OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-104774Medium 5.8OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-41504Medium 5.8OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-41508Medium 5.8OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-114099Medium 5.8Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
Assigned by VulnCheck
Oct 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .