[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwMPJNvwtB2XG1WMuwX3RMH2NE0bUdSLZLB8WsN1Qqec":3,"g5a-risk:CVE-2026-33691":156},{"success":4,"data":5,"meta":153},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":42,"epssPercentile":28,"epssTimeSeries":43,"severity":44,"affectedProducts":45,"affectedProductsCount":51,"references":52,"referencesCount":94,"weaknesses":95,"weaknessesCount":51,"isActivelyExploited":104,"cisaInfo":28,"otxData":28,"relatedBlogPosts":105,"seoMetadata":106,"configurations":131,"relatedVendorCves":144,"notableEvents":145},"CVE-2026-33691","What is CVE-2026-33691?","The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.","The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25....","2026-04-02T16:16:22.593","2026-07-24T21:10:00.143",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":39,"CVSSMetricV2":40,"CVSSMetricV40":41},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":23,"AvailabilityImpact":24,"BaseScore":26,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:N\u002FI:H\u002FA:N","NETWORK","HIGH","NONE","CHANGED",6.8,"MEDIUM",null,2.2,4,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":37,"ImpactScore":38},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":22,"AttackComplexity":35,"PrivilegesRequired":24,"UserInteraction":24,"Scope":36,"ConfidentialityImpact":24,"IntegrityImpact":23,"AvailabilityImpact":24,"BaseScore":12,"BaseSeverity":23,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"LOW","UNCHANGED",3.9,3.6,[],[],[],0.01578,[42,42,42,42,42,42,42],"High",[46],{"vendor":47,"product":48,"version":49,"criteria":50,"vulnerable":4},"owasp","owasp_modsecurity_core_rule_set","*","cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*",1,[53,58,62,65,68,73,76,81,87,91],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Fcommit\u002F2a8c63512811c5dd74472becebb79a783e68ff02","GitHub",[57],"Patch",{"url":59,"source":55,"tags":60},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Fpull\u002F4546",[61,57],"Issue Tracking",{"url":63,"source":55,"tags":64},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Fpull\u002F4547",[61,57],{"url":66,"source":55,"tags":67},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Fpull\u002F4548",[57],{"url":69,"source":55,"tags":70},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Freleases\u002Ftag\u002Fv3.3.9",[71,72],"Product","Release Notes",{"url":74,"source":55,"tags":75},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Freleases\u002Ftag\u002Fv4.25.0",[71,72],{"url":77,"source":55,"tags":78},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Fsecurity\u002Fadvisories\u002FGHSA-rw5f-9w43-gv2w",[79,57,80],"Mitigation","Vendor Advisory",{"url":82,"source":83,"tags":84},"http:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2026\u002FApr\u002F0","Seclists",[85,86],"Mailing List","Third Party Advisory",{"url":88,"source":89,"tags":90},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F03\u002F29\u002F2","Openwall",[85,86],{"url":92,"source":89,"tags":93},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F04\u002F18\u002F4",[],10,[96],{"id":97,"name":98,"description":99,"extendedDescription":100,"status":101,"abstraction":102,"structure":103},"CWE-178","Improper Handling of Case Sensitivity","The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.","Improperly handled case sensitive data can lead to several possible consequences, including:","Incomplete","Base","Simple",false,[],{"title":107,"metaDescription":108,"keywords":109,"canonicalUrl":110,"structuredData":111},"What is CVE-2026-33691? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-33691, a high severity cyber security vulnerability from 2026. The OWASP core rule set (CRS) is a set of generic attack de...","CVE-2026-33691, CVE-2026-33691 vulnerability, CVE-2026-33691 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, owasp security, owasp_modsecurity_core_rule_set vulnerability","\u002Fwhat-is\u002Fcve-2026-33691",{"@context":112,"@type":113,"headline":107,"description":108,"datePublished":10,"dateModified":11,"author":114,"publisher":118,"about":122,"mainEntityOfPage":126,"articleSection":129,"keywords":130},"https:\u002F\u002Fschema.org","TechArticle",{"@type":115,"name":116,"url":117},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":115,"name":116,"url":117,"logo":119},{"@type":120,"url":121},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":123,"name":6,"description":124,"additionalType":125},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":127,"@id":128},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-33691","Cybersecurity","CVE-2026-33691, CVE-2026-33691 vulnerability, CVE-2026-33691 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[132],{"Operator":28,"Negate":28,"Nodes":133},[134],{"Operator":135,"Negate":104,"CPEMatch":136},"OR",[137,140],{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":138,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":139,"VersionEndIncluding":28},"33F8A888-1ED5-40BC-B1B9-7AA88411B0E0","3.3.9",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":141,"VersionStartExcluding":28,"VersionStartIncluding":142,"VersionEndExcluding":143,"VersionEndIncluding":28},"8822CE75-E018-4576-B30B-A25A1A2F60E0","4.0.0","4.25.0",[],[146],{"id":147,"eventType":148,"eventTime":149,"details":150,"label":151,"color":152},"9454c4ee-4a57-4a95-a2a1-61c9fa22502d","NEW_NVD","2026-04-13T15:55:32.771326+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":154,"version":155},1792266156097,"2.0",{"score":157,"band":158,"action":159,"scoredAt":160},47,"Medium","Plan remediation","2026-10-16T07:12:32.332487+00:00"]