Read the docs

F5

Records1058All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical89CVSS 9.0–10.0
CVSS high585CVSS 7.0–8.9

Exploited now

F5 records in CISA KEV
TI-2026-63338 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability Priority CRITICAL 99KEV 2026-09-22TI-2025-33465 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability Priority CRITICAL 99KEV 2026-03-27TI-2018-10499 Linux Kernel Integer Overflow Vulnerability Priority CRITICAL 93KEV 2026-01-26TI-2023-25230 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2023-10-31TI-2023-25231 F5 BIG-IP Configuration Utility SQL Injection Vulnerability Priority CRITICAL 97KEV 2023-10-31TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10

Components

Products in the NVD configurations · select one to filter the records
Big-ip Access Policy Manager 630 records CRITICAL Big-ip Application Security Manager 581 records CRITICAL Big-ip Advanced Firewall Manager 552 records CRITICAL Big-ip Local Traffic Manager 541 records CRITICAL Big-ip Policy Enforcement Manager 533 records CRITICAL Big-ip Link Controller 525 records CRITICAL Big-ip Application Acceleration Manager 524 records CRITICAL Big-ip Analytics 511 records CRITICAL

Records

8 records in Dos · all components

TI-2026-31136 CVE-2026-42945 · GHSA-gcgv-v5gf-c543

NGINX ngx_http_rewrite_module vulnerability

Priority HIGH 78

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.68047 Published 2026-05-13 Fixed in R37, R36 P4 +3 CWE-122
TI-2026-08132 CVE-2026-9256 · GHSA-h78r-86c6-jgp4

NGINX ngx_http_rewrite_module vulnerability

Priority MEDIUM 55

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.10856 Published 2026-05-22 Partial fix · 37.0.1.1, R36 P5 +3 CWE-122
TI-2026-31137 CVE-2026-42946 · GHSA-fm65-xrrr-c358

NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

Priority LOW 38

A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00932 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-789
TI-2026-29212 CVE-2026-40460 · GHSA-h7rq-f9gq-mc8r

NGINX ngx_quic_module vulnerability

Priority LOW 37

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00373 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-290
TI-2026-35579 CVE-2026-48142 · GHSA-2388-jp8v-fg9w

NGINX ngx_http_charset_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00684 Published 2026-06-17 Partial fix · 1.31.2, 1.30.3 +2 CWE-125
TI-2026-31131 CVE-2026-42934 · GHSA-6vmc-2wh4-77qp

NGINX ngx_http_charset_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00731 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-125
TI-2026-29378 CVE-2026-40701 · GHSA-x88q-x2r7-vg3g

NGINX ngx_http_ssl_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0069 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-416
Open these records in search →