F5 BIG-IP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
166 matching records
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects,Check if you run itEPSS 0.55%Oct 28, 2026
- High7.5In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for fivCheck if you run itEPSS 0.52%Oct 28, 2026
- Critical9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referenciCheck if you run itEPSS 0.84%Oct 14, 2026
- High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutCheck if you run itEPSS 0.38%Oct 14, 2026
- High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtCheck if you run itEPSS 0.21%Oct 14, 2026
- Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuCheck if you run itEPSS 0.32%Oct 14, 2026
- Medium6.9NGINX ngx_http_v3_module vulnerabilityCheck if you run itEPSS 0.35%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.Check if you run itEPSS 0.39%Oct 14, 2026
- High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.Check if you run itEPSS 0.26%Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unCheck if you run itEPSS 0.48%Oct 14, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.Check if you run itEPSS 0.83%Oct 14, 2026
- Critical9.2NGINX map directive and regex matching vulnerabilityCheck if you run itEPSS 1.20%Oct 14, 2026
- Critical9.3F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityPatch nowKEVEPSS 26.55%Sep 22, 2026
- High8.8F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by…Check if you run itEPSS 0.59%Jun 1, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Check this weekEPSS 10.86%May 22, 2026
- Critical9.2NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*,…Check if you run itEPSS 9.69%May 19, 2026
- High8.3A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.Check if you run itEPSS 0.93%May 13, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Patch nowKEVEPSS 68.05%May 13, 2026
- High7.1Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST.Check if you run itEPSS 0.20%May 13, 2026
- Medium6.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.Check if you run itEPSS 0.73%May 13, 2026
- High8.5When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.Check if you run itEPSS 0.48%May 13, 2026
- Medium6.3When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame…Check if you run itEPSS 0.35%May 13, 2026
- High8.5An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation.Check if you run itEPSS 0.25%May 13, 2026
- High8.7When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM…Check if you run itEPSS 0.26%May 13, 2026
- High7.1A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges.Check if you run itEPSS 0.29%May 13, 2026