CVE WATCH / VULNERABILITY DETAIL
CVE-2026-104774
MEDIUMCVSS 5.8NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggere
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104935
- CVE-2026-109573 HIGH 8.1
- CVE-2026-84312 HIGH 7.1
- CVE-2026-41210 MEDIUM 6.5
- CVE-2026-84316 HIGH 8.8
- CVE-2026-84317 HIGH 8.8
- CVE-2026-84318 HIGH 8.8
- CVE-2026-84319 HIGH 8.3
- CVE-2026-84320 MEDIUM 6.3
- CVE-2026-84321 MEDIUM 5.4