F5 - vulnerabilities (CVEs)

1059 CVEs in 330 products, 11 in the last 30 days, newest from 2026-10-14.

Products

Big-ip Access Policy Manager - 630 CVEs
Big-ip Application Security Manager - 580 CVEs
Big-ip Advanced Firewall Manager - 552 CVEs
Big-ip Local Traffic Manager - 541 CVEs
Big-ip Policy Enforcement Manager - 533 CVEs
Big-ip Link Controller - 525 CVEs
Big-ip Application Acceleration Manager - 524 CVEs
Big-ip Analytics - 511 CVEs
Big-ip Global Traffic Manager - 490 CVEs
Big-ip Domain Name System - 469 CVEs
Big-ip Fraud Protection Service - 405 CVEs
Big-ip Webaccelerator - 297 CVEs
Big-ip Edge Gateway - 293 CVEs
Big-ip - 262 CVEs
Big-ip Advanced Web Application Firewall - 195 CVEs
Big-ip Websafe - 175 CVEs
Big-ip Ddos Hybrid Defender - 166 CVEs
Big-ip Ssl Orchestrator - 147 CVEs
Big-ip Carrier-grade Nat - 109 CVEs
Big-ip Application Visibility And Reporting - 108 CVEs
Big-ip Container Ingress Services - 86 CVEs
Big-ip Automation Toolchain - 85 CVEs
Big-iq Centralized Management - 85 CVEs
Big-ip Protocol Security Module - 61 CVEs
Nginx - 45 CVEs
Njs - 40 CVEs
Enterprise Manager - 39 CVEs
Big-ip Wan Optimization Manager - 38 CVEs
Nginx Plus - 37 CVEs
Nginx Open Source - 35 CVEs
Traffix Signaling Delivery Controller - 31 CVEs
Big-ip Next Cloud-native Network Functions - 27 CVEs
Ssl Orchestrator - 27 CVEs
Big-ip Next Cnf - 26 CVEs
Nginx Ingress Controller - 25 CVEs
Big-ip Next Service Proxy For Kubernetes - 24 CVEs
Big-ip Next Spk - 23 CVEs
Big-iq - 23 CVEs
Big-ip Access Policy Manager Client - 20 CVEs
Big-iq Cloud - 20 CVEs
Big-iq Device - 20 CVEs
Big-iq Security - 20 CVEs
Nginx Instance Manager - 19 CVEs
Nginx Controller - 18 CVEs
Nginx Gateway Fabric - 18 CVEs
Asm - 17 CVEs
F5os-a - 17 CVEs
Iworkflow - 17 CVEs
Big-ip Dns - 14 CVEs
F5os-c - 14 CVEs
Apm - 13 CVEs
Big-ip Ltm - 13 CVEs
Big-ip Next For Kubernetes - 13 CVEs
Big-iq Cloud And Orchestration - 13 CVEs
Big-ip Apm - 12 CVEs
Big-ip Next Central Manager - 12 CVEs
F5os - Appliance - 12 CVEs
Pem - 12 CVEs
Waf - 12 CVEs
Aam - 11 CVEs
Afm - 11 CVEs
Big-ip Edge Client - 11 CVEs
Link Controller - 11 CVEs
Analytics - 10 CVEs
Big-ip Enterprise Manager - 10 CVEs
Dns - 10 CVEs
F5os - Chassis - 10 CVEs
Gtm - 10 CVEs
Webaccelerator - 10 CVEs
Big-iq Application Delivery Controller - 9 CVEs
Edge Gateway - 9 CVEs
Dos - 8 CVEs
Fps - 8 CVEs
Big-ip Afm - 7 CVEs
Big-iq Adc - 7 CVEs
Firepass 4100 - 7 CVEs
Tmos - 7 CVEs
Access Policy Manager Clients - 6 CVEs
Big-ip Guided Configuration - 6 CVEs
Big-ip Protocol Security Manager - 6 CVEs
Nginx Javascript - 6 CVEs
Firepass - 5 CVEs
Arx - 4 CVEs
Arx Firmware - 4 CVEs
Big-ip Asm - 4 CVEs
Big-ip Guided Configuration Gc - 4 CVEs
Big-ip Next - 4 CVEs
F5 Iworkflow - 4 CVEs
Big-ip Advanced Waf - 3 CVEs
Big-ip Advanced Waf Asm - 3 CVEs
Big-ip Apm Clients - 3 CVEs
Big-ip Edge - 3 CVEs
Big-ip Pem - 3 CVEs
Big-ip Service Proxy - 3 CVEs
Big-ip Spk - 3 CVEs
F5 Access - 3 CVEs
Nginx Agent - 3 CVEs
Nginx Api Connectivity Manager - 3 CVEs
Websafe Alert Server - 3 CVEs
Access For Android - 2 CVEs
And Apm - 2 CVEs
Apm Clients - 2 CVEs
Big-ip 10000s Firmware - 2 CVEs
Big-ip Controller - 2 CVEs
Big-ip Fraud Protection Services - 2 CVEs
Big-ip I10600 Firmware - 2 CVEs
Big-ip I10800 Firmware - 2 CVEs
Big-ip I11600 Firmware - 2 CVEs
Big-ip I11800 Firmware - 2 CVEs
Big-ip I15600 Firmware - 2 CVEs
Big-ip I15800 Firmware - 2 CVEs
Big-ip I5600 Firmware - 2 CVEs
Big-ip I5800 Firmware - 2 CVEs
Big-ip I7600 Firmware - 2 CVEs
Big-ip I7800 Firmware - 2 CVEs
F5 Ssl Orchestrator - 2 CVEs
Firepass Ssl Vpn - 2 CVEs
Nginx Open Source Subscription - 2 CVEs
Nginx Security Monitoring - 2 CVEs
Nginx Unit - 2 CVEs
Ssl Intercept Iapp - 2 CVEs
Traffix Sdc - 2 CVEs
Traffix Systems Signaling Delivery Controller - 2 CVEs
Websafe - 2 CVEs
Advanced Waf - 1 CVEs
Application Security Manager Appliance - 1 CVEs
Arx Data Manager - 1 CVEs
Big-ip 1000 - 1 CVEs
Big-ip 10050s Firmware - 1 CVEs
Big-ip 10150v-n Firmware - 1 CVEs
Big-ip 10200v-f Firmware - 1 CVEs
Big-ip 10200v-s Firmware - 1 CVEs
Big-ip 10200v-ssl Firmware - 1 CVEs
Big-ip 10200v Firmware - 1 CVEs
Big-ip 10250v Firmware - 1 CVEs
Big-ip 10350v-f Firmware - 1 CVEs
Big-ip 10350v-n Firmware - 1 CVEs
Big-ip 11000 - 1 CVEs
Big-ip 11000-f Firmware - 1 CVEs
Big-ip 11050 - 1 CVEs
Big-ip 11050-f Firmware - 1 CVEs
Big-ip 12000 Firmware - 1 CVEs
Big-ip 12250v Firmware - 1 CVEs
Big-ip 1500 - 1 CVEs
Big-ip 1600 - 1 CVEs
Big-ip 2400 - 1 CVEs
Big-ip 3400 - 1 CVEs
Big-ip 3410 - 1 CVEs
Big-ip 3600 - 1 CVEs
Big-ip 3900 - 1 CVEs
Big-ip 4100 - 1 CVEs
Big-ip 5000s Firmware - 1 CVEs
Big-ip 5100 - 1 CVEs
Big-ip 5110 - 1 CVEs
Big-ip 5200v-ssl Firmware - 1 CVEs
Big-ip 5200v Firmware - 1 CVEs
Big-ip 5250v-f Firmware - 1 CVEs
Big-ip 6400 - 1 CVEs
Big-ip 6800 - 1 CVEs
Big-ip 6900 - 1 CVEs
Big-ip 6900-f Firmware - 1 CVEs
Big-ip 7000s Firmware - 1 CVEs
Big-ip 7200v-f Firmware - 1 CVEs
Big-ip 7200v-ssl Firmware - 1 CVEs
Big-ip 7200v Firmware - 1 CVEs
Big-ip 8400 - 1 CVEs
Big-ip 8800 - 1 CVEs
Big-ip 8900 - 1 CVEs
Big-ip 8900-f Firmware - 1 CVEs
Big-ip 8950 - 1 CVEs
Big-ip Afm Pem - 1 CVEs
Big-ip Apm Edge Client - 1 CVEs
Big-ip B2250 Firmware - 1 CVEs
Big-ip B4300 Firmware - 1 CVEs
Big-ip B4340n Firmware - 1 CVEs
Big-ip B4450n Firmware - 1 CVEs
Big-ip Configuration Utility - 1 CVEs
Big-ip Datasafe - 1 CVEs
Big-ip Global Traffic Manager11.2.0 - 1 CVEs
Big-ip I15820-df Firmware - 1 CVEs
Big-ip I5820-df Firmware - 1 CVEs
Big-ip I7820-df Firmware - 1 CVEs
Big-ip Policy Enforcement Manager11.5.1 - 1 CVEs
Big-ip Policy Webaccelerator - 1 CVEs
Big-ip Virtual Edition - 1 CVEs
Big-ip Webaccelerator12.1.1 - 1 CVEs
Big Ip - 1 CVEs
Container Ingress Service - 1 CVEs
Edge Client For Windows - 1 CVEs
F5 Access For Android - 1 CVEs
F5 Big-ip Container Ingress Services - 1 CVEs
F5 Websafe - 1 CVEs
F5os - 1 CVEs
Firepass 1000 - 1 CVEs
Firepass 1200 - 1 CVEs
Icontrol Service Manager - 1 CVEs
Linerate - 1 CVEs
Mobilesafe - 1 CVEs
Nginx App Protect - 1 CVEs
Nginx App Protect Waf - 1 CVEs
Nginx Controller Api Management - 1 CVEs
Nginx Modsecurity Waf - 1 CVEs
Nginx Openid Connect - 1 CVEs
Nginx Service Mesh - 1 CVEs
R10600 Firmware - 1 CVEs
R10800 Firmware - 1 CVEs
R10900 Firmware - 1 CVEs
R5600 Firmware - 1 CVEs
R5800 Firmware - 1 CVEs
R5900 Firmware - 1 CVEs
Silverline - 1 CVEs
Velos Bx110 Firmware - 1 CVEs
Viprion 2200 Firmware - 1 CVEs
Viprion B2100 Firmware - 1 CVEs
Viprion B2150 Firmware - 1 CVEs
Viprion B2250 Firmware - 1 CVEs
Viprion B4300 Firmware - 1 CVEs
Viprion B4450 Firmware - 1 CVEs
3 Dns - 0 CVEs
Big-ip 10000s - 0 CVEs
Big-ip 10050s - 0 CVEs
Big-ip 10150v-n - 0 CVEs
Big-ip 10200v - 0 CVEs
Big-ip 10200v-f - 0 CVEs
Big-ip 10200v-s - 0 CVEs
Big-ip 10200v-ssl - 0 CVEs
Big-ip 10250v - 0 CVEs
Big-ip 10350v-f - 0 CVEs
Big-ip 10350v-n - 0 CVEs
Big-ip 11000-f - 0 CVEs
Big-ip 11050-f - 0 CVEs
Big-ip 12000 - 0 CVEs
Big-ip 12250v - 0 CVEs
Big-ip 2000 - 0 CVEs
Big-ip 2000s - 0 CVEs
Big-ip 2200s - 0 CVEs
Big-ip 2800 - 0 CVEs
Big-ip 4000 - 0 CVEs
Big-ip 4000s - 0 CVEs
Big-ip 4200v - 0 CVEs
Big-ip 5000s - 0 CVEs
Big-ip 5200v - 0 CVEs
Big-ip 5200v-ssl - 0 CVEs
Big-ip 5250v-f - 0 CVEs
Big-ip 6900-f - 0 CVEs
Big-ip 7000s - 0 CVEs
Big-ip 7200v - 0 CVEs
Big-ip 7200v-f - 0 CVEs
Big-ip 7200v-ssl - 0 CVEs
Big-ip 8900-f - 0 CVEs
Big-ip Aam - 0 CVEs
Big-ip B2250 - 0 CVEs
Big-ip B4300 - 0 CVEs
Big-ip B4340n - 0 CVEs
Big-ip B4450n - 0 CVEs
Big-ip Edge Fraud Protection Service - 0 CVEs
Big-ip I10600 - 0 CVEs
Big-ip I10800 - 0 CVEs
Big-ip I11600 - 0 CVEs
Big-ip I11800 - 0 CVEs
Big-ip I15600 - 0 CVEs
Big-ip I15800 - 0 CVEs
Big-ip I15820-df - 0 CVEs
Big-ip I2000 - 0 CVEs
Big-ip I2000s - 0 CVEs
Big-ip I2200s - 0 CVEs
Big-ip I2600 - 0 CVEs
Big-ip I2800 - 0 CVEs
Big-ip I4000 - 0 CVEs
Big-ip I4000s - 0 CVEs
Big-ip I4200v - 0 CVEs
Big-ip I4600 - 0 CVEs
Big-ip I4800 - 0 CVEs
Big-ip I5000s - 0 CVEs
Big-ip I5050s - 0 CVEs
Big-ip I5200v - 0 CVEs
Big-ip I5250v - 0 CVEs
Big-ip I5250v Fips - 0 CVEs
Big-ip I5600 - 0 CVEs
Big-ip I5800 - 0 CVEs
Big-ip I5820-df - 0 CVEs
Big-ip I7000 - 0 CVEs
Big-ip I7050s - 0 CVEs
Big-ip I7055s - 0 CVEs
Big-ip I7200v - 0 CVEs
Big-ip I7200v-ssl - 0 CVEs
Big-ip I7200v Fips - 0 CVEs
Big-ip I7250v - 0 CVEs
Big-ip I7255s - 0 CVEs
Big-ip I7600 - 0 CVEs
Big-ip I7800 - 0 CVEs
Big-ip I7820-df - 0 CVEs
Big-ip I850 - 0 CVEs
Ddos Hybrid Defender - 0 CVEs
Edge Fx - 0 CVEs
Firepass 4300 - 0 CVEs
Global-site - 0 CVEs
Nginx App Protect Dos - 0 CVEs
Nginx Dos - 0 CVEs
Nginx Waf - 0 CVEs
R10600 - 0 CVEs
R10800 - 0 CVEs
R10900 - 0 CVEs
R10920-df - 0 CVEs
R12600-ds - 0 CVEs
R12800-ds - 0 CVEs
R12900-ds - 0 CVEs
R2000 - 0 CVEs
R4000 - 0 CVEs
R5600 - 0 CVEs
R5800 - 0 CVEs
R5900 - 0 CVEs
R5920-df - 0 CVEs
Velos Bx110 - 0 CVEs
Velos Cx1610 - 0 CVEs
Velos Cx410 - 0 CVEs
Viprion 2100 Blades - 0 CVEs
Viprion 2200 - 0 CVEs
Viprion 4200 Blades - 0 CVEs
Viprion 4300 Blades - 0 CVEs
Viprion 4450 Blades - 0 CVEs
Viprion Application Delivery Controller - 0 CVEs
Viprion B2100 - 0 CVEs
Viprion B2150 - 0 CVEs
Viprion B2250 - 0 CVEs
Viprion B4300 - 0 CVEs
Viprion B4450 - 0 CVEs
Viprion Performance Blade 100 - 0 CVEs
Viprion Performance Blade 200 - 0 CVEs
Vpn Client For Windows - 0 CVEs

Newest CVEs of F5

CVE-2026-104939 - CVSS 8.7 (high), 2026-10-14: Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP…
CVE-2026-101025 - CVSS 6.9 (medium), 2026-10-14: Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path…
CVE-2026-101019 - CVSS 8.3 (high), 2026-10-14: Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2…
CVE-2026-96615 - CVSS 7.1 (high), 2026-10-14: Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC…
CVE-2026-95101 - CVSS 6.9 (medium), 2026-10-14: Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering…
CVE-2026-94197 - CVSS 8.7 (high), 2026-10-14: An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy…
CVE-2026-97205 - CVSS 9.2 (critical), 2026-10-14: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain…
CVE-2026-91184 - CVSS 8.8 (high), 2026-10-14: Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter…
CVE-2026-93479 - CVSS 9.2 (critical), 2026-10-14: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the…
CVE-2026-15176 - CVSS 9.2 (critical), 2026-10-14: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or…
CVE-2026-97629 - CVSS 8.3 (high), 2026-10-14: Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key…
CVE-2026-94127 - CVSS 9.8 (critical), 2026-09-22: When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).…
CVE-2026-90439 - CVSS 6.9 (medium), 2026-09-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain…
CVE-2026-78689 - CVSS 9.2 (critical), 2026-09-02: Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An…
CVE-2026-78222 - CVSS 8.7 (high), 2026-09-02: A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads…
CVE-2026-77180 - CVSS 8.7 (high), 2026-09-02: When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress…
CVE-2026-66842 - CVSS 8.8 (high), 2026-09-02: BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to…
CVE-2026-66362 - CVSS 8.6 (high), 2026-09-02: Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator…
CVE-2026-63020 - CVSS 3.1 (low), 2026-09-02: A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick…
CVE-2026-18329 - CVSS 8.8 (high), 2026-09-02: Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and…
CVE-2026-60005 - CVSS 8.8 (high), 2026-07-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured…
CVE-2026-60065 - CVSS 6.3 (medium), 2026-07-15: When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers…
CVE-2026-56434 - CVSS 8.3 (high), 2026-07-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI),…
CVE-2026-42533 - CVSS 9.2 (critical), 2026-07-15: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture…
CVE-2026-60062 - CVSS 6.4 (medium), 2026-07-15: The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure…
CVE-2026-52865 - CVSS 7.1 (high), 2026-07-15: When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or…
CVE-2026-59762 - CVSS 8.7 (high), 2026-07-15: When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System…
CVE-2026-55723 - CVSS 8.7 (high), 2026-07-15: When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the…
CVE-2026-50107 - CVSS 8.6 (high), 2026-06-17: When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration…
CVE-2026-32682 - CVSS 7.1 (high), 2026-06-17: When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause…