Browse CVEs

HIGH 7.8 CVE-2026-27784 The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or o… Nginx Open Source 1.28.3 / 1.29.7+ Fix from $1,9502026-03-24 MEDIUM 5.4 CVE-2026-28755 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when c… Nginx Plus 1.28.3 / 1.29.7+ Fix from $1,6002026-03-24 HIGH 7.5 CVE-2026-27651 When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate… Nginx Open Source 1.28.3 / 1.29.7+ Fix from $1,9502026-03-24 MEDIUM 5.9 CVE-2026-1642 A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a ma… Nginx Gateway Fabric 1.28.2 / 1.29.5+ Fix from $1,6002026-02-04 MEDIUM 5.9 CVE-2026-22548 When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's… Big Ip Advanced Web Application Firewall 17.1.3+ Fix from $1,6002026-02-04 HIGH 8.3 CVE-2025-14727 A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached En… Nginx Ingress Controller Mitigation only Fix from $1,9502025-12-17 HIGH 7.5 CVE-2025-58071 When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software v… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61935 When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.  Not… Big Ip Advanced Web Application Firewall 15.1.10.8 / 17.1.3+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61990 When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  No… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,9502025-10-15 MEDIUM 6.1 CVE-2025-61933 A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the con… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,6002025-10-15 HIGH 8.8 CVE-2025-57780 A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges.  A succes… F5os A 1.5.4 / 1.8.2+ Fix from $1,9502025-10-15 HIGH 8.7 CVE-2025-61958 A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh res… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61960 When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkerne… Big Ip Access Policy Manager 16.1.6.1 / 17.1.3+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61974 When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Softwa… Big Ip Next Cloud Native Network Functions after 2.1.0 Fix from $1,9502025-10-15 HIGH 8.8 CVE-2025-61955 A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.  A succe… F5os A 1.5.4 / 1.8.2+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-60016 When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and… Big Ip Next Cloud Native Network Functions 1.4.0+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61938 When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enfor… Big Ip Advanced Web Application Firewall 17.1.3+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-61951 Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer Security (… Big Ip Access Policy Manager 16.1.6.1 / 17.1.3+ Fix from $1,9502025-10-15 MEDIUM 5.7 CVE-2025-60015 An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.  Note: Software versions which have reach… F5os A 1.5.4 / 1.8.2+ Fix from $1,6002025-10-15 HIGH 7.5 CVE-2025-59781 When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilizat… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6+ Fix from $1,9502025-10-15 HIGH 8.7 CVE-2025-59481 A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least re… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-59478 When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management… Big Ip Advanced Firewall Manager 15.1.10.8 / 17.1.3+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-59778 When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to termi… F5os C 1.8.2+ Fix from $1,9502025-10-15 MEDIUM 6.5 CVE-2025-59483 A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Su… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,6002025-10-15 MEDIUM 6.1 CVE-2025-59269 A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run Ja… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,6002025-10-15 MEDIUM 5.3 CVE-2025-58474 When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured w… Big Ip Advanced Web Application Firewall 17.1.2+ Fix from $1,6002025-10-15 MEDIUM 5.3 CVE-2025-59268 On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker throug… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,6002025-10-15 HIGH 7.5 CVE-2025-58096 When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,9502025-10-15 HIGH 7.5 CVE-2025-58120 When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions whic… Big Ip Next Cloud Native Network Functions 1.7.14+ Fix from $1,9502025-10-15 MEDIUM 5.9 CVE-2025-58153 Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experie… Big Ip Access Policy Manager 15.1.10.8 / 16.1.6.1+ Fix from $1,6002025-10-15