Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.7When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.May 13, 2026
- High8.5When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker wi…May 13, 2026
- High8.7When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.May 13, 2026
- High8.6A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configura…May 13, 2026
- High8.7When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause…May 13, 2026
- High8.7When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process…May 13, 2026
- High7.1An authenticated iControl SOAP user may be able to obtain information of other accounts.May 13, 2026
- High8.5When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint.May 13, 2026
- Medium6.3When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (…May 13, 2026
- High8.5A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary…May 13, 2026
- High8.5A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configurati…May 13, 2026
- Medium6.7When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the i…May 13, 2026
- Medium6.9When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with admin…May 13, 2026
- High7.2An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.EPSS 0.4%May 13, 2026
- High7.1In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queues is a count incremented in nvm…May 8, 2026
- High8.8In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series…May 6, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: mm/kasan: fix double free for kasan pXds kasan_free_pxd() assumes the page table is always struct p…Apr 27, 2026
- High8.5NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to t…Mar 24, 2026
- Medium5.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the…Mar 24, 2026
- Medium6.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses.Mar 24, 2026
- High8.5The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX wo…Mar 24, 2026
- High8.8ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution VulnerabilityEPSS 25.1%Mar 24, 2026
- High8.7When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate.Mar 24, 2026
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with…EPSS 0.6%Dec 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can ina…EPSS 0.2%Dec 4, 2025