F5 BIG-IP security vulnerabilities
Application delivery. Public CVE monitoring for F5 BIG-IP. Vendor security advisories are linked on this page.
Built for Operators of this product.
166 public records · 0 security-fix timeline events. 2 published in the last 7 days. 140 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 5
- High 6
- Medium 2
- Low 0
2026-08-0413 issues2026-11-01
Known exploited
View all known exploited- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Patch nowKEVEPSS 68.05%May 13, 2026
- Critical9.3F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityPatch nowKEVEPSS 26.55%Sep 22, 2026
- High7.8Linux Kernel Integer Overflow VulnerabilityPatch nowKEVEPSS 14.69%Sep 25, 2018
- Critical9.3F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityPatch nowKEVEPSS 2.30%Oct 15, 2025
Recently published
Browse catalog- Critical9.8In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects,Check if you run itEPSS 0.55%Oct 28, 2026
- High7.5In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for fivCheck if you run itEPSS 0.52%Oct 28, 2026
- Critical9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referenciCheck if you run itEPSS 0.84%Oct 14, 2026
- High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutCheck if you run itEPSS 0.38%Oct 14, 2026
- High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtCheck if you run itEPSS 0.21%Oct 14, 2026
- Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuCheck if you run itEPSS 0.32%Oct 14, 2026
- Medium6.9NGINX ngx_http_v3_module vulnerabilityCheck if you run itEPSS 0.35%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.Check if you run itEPSS 0.39%Oct 14, 2026
- High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.Check if you run itEPSS 0.26%Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unCheck if you run itEPSS 0.48%Oct 14, 2026