C
Vendor security profile
corazawaf
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit6
Patch rate%0
Avg. CVSS5.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
0
9
CVE KEV
CVE severity distribution
9toplam CVE
High2 (22%)
Medium7 (78%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%67
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
5.8
CVE-2026-41508
OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
C
Patch status unknownEPSS %0
5.8
CVE-2026-41504
OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
C
Patch status unknownEPSS %0
5.8
CVE-2026-104774
OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
C
Patch status unknownEPSS %0
7.2
CVE-2026-41510
OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
C
Patch status unknownEPSS %0
4.0
CVE-2026-107835
OWASP Coraza WAF: Cookie Parser Confusion
C
Patch status unknownEPSS %0
5.3
CVE-2026-107834
OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
C
Patch status unknownEPSS %0
5.9
CVE-2026-107833
OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
C
Patch status unknownEPSS %0
7.5
CVE-2026-107826
OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
C
Patch status unknownEPSS %0
4.0
CVE-2026-107825
OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
C
Patch status unknownEPSS %0