11 Pull requests merged by 6 people

• fix: 932280/932281 bypass

  #4207 merged Jul 14, 2025

• feat: added detection for LaTeX injection

  #4206 merged Jul 14, 2025

• chore: update restricted-upload-data with crs-toolchain

  #4117 merged Jul 13, 2025

• fix(pre-commit): do not run every time on all yaml files

  #4205 merged Jul 12, 2025

• feat: added detection for RCE via Referer header

  #3993 merged Jul 12, 2025

• fix(test): move xss test from 942180 to 941210

  #4012 merged Jul 12, 2025

• feat: remove PCI DSS tags (#4194)

  #4203 merged Jul 11, 2025

• ci: add pre-commit crs-toolchain run

  #4182 merged Jul 11, 2025

• feat: add file which contains rule id's without tests

  #4186 merged Jul 11, 2025

• fix(932281): avoid matching on json payloads

  #4187 merged Jul 9, 2025

• fix(931130): update file uri with single slash

  #4193 merged Jul 9, 2025

3 Pull requests opened by 3 people

• fix: update url-schemes.ra

  #4199 opened Jul 10, 2025

• [pre-commit.ci] pre-commit autoupdate

  #4209 opened Jul 14, 2025

• fix(934190): remove forward slash

  #4210 opened Jul 15, 2025

11 Issues closed by 5 people

• Remove Rule Duplicates That Are Due to Modsecurity 2 httpd Regex Size Limitations

  #4149 closed Jul 12, 2025

• Detect RCE in fragments of URLs in Referer header (932205)

  #3498 closed Jul 12, 2025

• Remove PCI DSS tags from rules

  #4194 closed Jul 11, 2025

• Add pre-commit to execute crs-toolchain to fix when regexes are changed

  #4174 closed Jul 11, 2025

• git:// schema not detected

  #4196 closed Jul 10, 2025

• rmi:// and ldap:// not detected

  #4195 closed Jul 10, 2025

• WAF Bypass via jar:file uri schema

  #4192 closed Jul 9, 2025

• WAF Bypass

  #4188 closed Jul 9, 2025

• SQL Injection bypass WAF

  #4191 closed Jul 9, 2025

• SQL Injection WAF Bypass in PL 3

  #4190 closed Jul 9, 2025

• WAF Bypass via Overlong UTF-8

  #4189 closed Jul 9, 2025

6 Issues opened by 4 people

• Detection for Edge Side Includes(ESI)

  #4208 opened Jul 14, 2025

• WAF Bypass Command Injection

  #4204 opened Jul 11, 2025

• False positive (403 Forbidden) when nagivating to site homepage while behind a vpn on Google Chrome (MacOS)

  #4202 opened Jul 11, 2025

• Write blog post about PCI DSS

  #4201 opened Jul 11, 2025

• console.table(),document.body.remove(),document.title and console.clear() function and variable not detected

  #4198 opened Jul 10, 2025

• Update list of url-schemas

  #4197 opened Jul 10, 2025

5 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• fix(942550): cleanup regex

  #3767 commented on Jul 15, 2025 • 11 new comments

• feat: added detection for ruby errors and code leakage

  #4089 commented on Jul 10, 2025 • 2 new comments

• fix(security): resolve SQL injection protection bypass (942380 PL2)

  #3720 commented on Jul 13, 2025 • 1 new comment

• feat: added detection for quote evasion

  #3813 commented on Jul 9, 2025 • 0 new comments

• refactor: Suggestion to increase paranoia of 942430

  #4179 commented on Jul 13, 2025 • 0 new comments