Vendor
F5 vulnerabilities
276 advisories tracked, 8 exploited in the wild according to CISA, 86 published in 2026.
Data refreshed 12 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
CVE-2026-94127BIG-IP
BIG-IP APM OAuth vulnerabilityCVE-2025-53521BIG-IP
BIG-IP Stack-Based Buffer OverflowCVE-2026-27654NGINX
NGINX ngx_http_dav_module vulnerabilityCVE-2025-31644BIG-IP
Appliance mode BIG-IP iControl REST and tmsh vulnerabilityCVE-2024-45844BIG-IP
BIG-IP monitors vulnerabilityCVE-2023-22374BIG-IP
iControl SOAP vulnerability
Products covered
Select a product to see only its advisories.
- BIG-IPLTM, APM, ASM / Advanced WAF, AFM, DNS, SSL Orchestrator and the Configuration utility207 tracked
- BIG-IQ and F5OSCentral management and the F5OS platform software for rSeries and VELOS32 tracked
- NGINXNGINX Plus, Open Source, Ingress Controller, Instance Manager and App Protect52 tracked
- Distributed Cloud and other servicesF5 Distributed Cloud, Silverline and the F5 Access app3 tracked
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-94127Full analysis | BIG-IP | BIG-IP APM OAuth vulnerability | CRITICAL 9.3 | 2.2% | Yes | |
| CVE-2026-90439 | NGINX | NGINX ngx_http_v3_module vulnerability | MEDIUM 6.9 | 0.26% | – | |
| CVE-2026-77180Full analysis | NGINX | NGINX Ingress Controller vulnerability | HIGH 8.7 | 0.50% | – | |
| CVE-2026-78222 | NGINX | NGINX ngx_http_js_module vulnerability | HIGH 8.7 | 0.62% | – | |
| CVE-2026-18329 | NGINX | NGINX ngx_http_js_module vulnerability | HIGH 8.8 | 0.38% | – | |
| CVE-2026-66842 | BIG-IP | BIG-IP and BIG-IQ Configuration utility vulnerability | HIGH 8.7 | 0.47% | – | |
| CVE-2026-63020 | BIG-IP | BIG-IP Configuration utility vulnerability | LOW 2.3 | 0.23% | – | |
| CVE-2026-42533 | NGINX | NGINX Map directive and Regex matching vulnerability | CRITICAL 9.2 | 0.89% | – | |
| CVE-2026-52865 | NGINX | NGINX Ingress Controller vulnerability | HIGH 7.1 | 0.50% | – | |
| CVE-2026-55723 | NGINX | NGINX Ingress Controller vulnerability | HIGH 8.7 | 0.51% | – | |
| CVE-2026-56434 | NGINX | NGINX ngx_http_ssi_module vulnerability | HIGH 8.3 | 0.42% | – | |
| CVE-2026-59762 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 8.7 | 0.57% | – | |
| CVE-2026-60062 | NGINX | NGINX Agent Vulnerability | MEDIUM 5.3 | 0.30% | – | |
| CVE-2026-60065 | NGINX | NGINX Plus ngx_stream_mqtt_filter_module vulnerability | MEDIUM 6.3 | 0.45% | – | |
| CVE-2026-60005 | NGINX | NGINX ngx_http_slice_module vulnerability | HIGH 8.8 | 0.53% | – | |
| CVE-2026-11311 | NGINX | NGINX Gateway Fabric vulnerability | HIGH 8.6 | 0.57% | – | |
| CVE-2026-42055 | NGINX | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | CRITICAL 9.2 | 6.5% | – | |
| CVE-2026-42530 | NGINX | NGINX Open-Source ngx_http_v3_module vulnerability | CRITICAL 9.2 | 1.1% | – | |
| CVE-2026-48142 | NGINX | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.37% | – | |
| CVE-2026-32682 | NGINX | NGINX Gateway Fabric vulnerability | HIGH 7.1 | 0.50% | – | |
| CVE-2026-50107 | NGINX | NGINX Gateway Fabric vulnerability | HIGH 8.6 | 0.46% | – | |
| CVE-2026-9256 | NGINX | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 2.7% | – | |
| CVE-2026-8711 | NGINX | NGINX JavaScript vulnerability | CRITICAL 9.2 | 0.79% | – | |
| CVE-2026-41219 | BIG-IP | BIG-IP QKView vulnerability | HIGH 7.1 | 0.38% | – | |
| CVE-2026-20916 | BIG-IQ and F5OS | BIG-IQ iControl REST vulnerability | HIGH 7.2 | 0.37% | – | |
| CVE-2026-24464 | BIG-IP | Appliance mode iControl REST vulnerability | MEDIUM 6.9 | 0.89% | – | |
| CVE-2026-28758 | BIG-IP | BIG-IP iControl REST vulnerability | MEDIUM 6.7 | 0.11% | – | |
| CVE-2026-32643 | BIG-IP | BIG-IP and BIG-IQ privilege escalation vulnerability | HIGH 8.5 | 0.26% | – | |
| CVE-2026-32673 | BIG-IP | BIG-IP scripted monitor vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-34019 | BIG-IP | BIG-IP BFD vulnerability | MEDIUM 6.3 | 0.40% | – | |
| CVE-2026-35062 | BIG-IP | iControl SOAP vulnerability | HIGH 7.1 | 0.34% | – | |
| CVE-2026-39455 | BIG-IP | BIG-IP Configuration utility vulnerability | HIGH 8.7 | 0.54% | – | |
| CVE-2026-39458 | BIG-IP | BIG-IP DNS Cache vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-39459 | BIG-IP | iControl REST and tmsh vulnerability | HIGH 8.6 | 0.46% | – | |
| CVE-2026-40060 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-40061 | BIG-IP | iControl REST and tmsh vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-40067 | BIG-IP | BIG-IP APM Vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-40423 | BIG-IP | BIG-IP SIP profile vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-40435 | BIG-IP | BIG-IP httpd access control vulnerability | MEDIUM 6.9 | 0.31% | – | |
| CVE-2026-40460 | NGINX | NGINX ngx_quic_module vulnerability | MEDIUM 6.9 | 0.38% | – | |
| CVE-2026-40462 | BIG-IP | iControl REST and tmsh vulnerability | HIGH 7.1 | 0.34% | – | |
| CVE-2026-40618 | BIG-IP | BIG-IP SSL/TLS vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-40629 | BIG-IP | BIG-IP SSL/TLS vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-40631 | BIG-IP | BIG-IP iControl SOAP vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-40698 | BIG-IP | iControl REST and TMSH vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-40699 | BIG-IP | BIG-IP Configuration utility vulnerability | HIGH 7.1 | 0.38% | – | |
| CVE-2026-40701 | NGINX | NGINX ngx_http_ssl_module vulnerability | MEDIUM 6.3 | 0.69% | – | |
| CVE-2026-40703 | BIG-IP | BIG-IP Configuration utility CSRF vulnerability | MEDIUM 5.3 | 0.14% | – | |
| CVE-2026-41217 | BIG-IP | BIG-IP tmsh vulnerability | HIGH 8.3 | 0.16% | – | |
| CVE-2026-41218 | BIG-IP | BIG-IP PEM iRules vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-41225 | BIG-IP | iControl REST vulnerability | HIGH 8.6 | 0.46% | – | |
| CVE-2026-41227 | BIG-IP | BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-41953 | BIG-IP | BIG-IP Privilege Escalation vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-41954 | BIG-IP | iControl REST and tmsh vulnerability | MEDIUM 6.9 | 0.40% | – | |
| CVE-2026-41956 | BIG-IP | BIG-IP TMM Vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-41957 | BIG-IP | BIG-IP and BIG-IQ Configuration utility vulnerability | HIGH 8.7 | 0.87% | – | |
| CVE-2026-41959 | BIG-IP | iControl and tmsh REST vulnerability | HIGH 7.1 | 0.28% | – | |
| CVE-2026-42058 | BIG-IP | BIG-IP iControl REST vulnerability | MEDIUM 5.3 | 0.26% | – | |
| CVE-2026-42063 | BIG-IP | iControl SOAP vulnerability | MEDIUM 6.9 | 0.40% | – | |
| CVE-2026-42406 | BIG-IP | BIG-IP and BIG-IQ privilege escalation vulnerability | HIGH 8.5 | 0.25% | – | |
| CVE-2026-42408 | BIG-IP | BIG-IP DNS tmsh vulnerability | MEDIUM 6.7 | 0.11% | – | |
| CVE-2026-42409 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-42780 | BIG-IP | BIG-IP SSL Orchestrator vulnerability | MEDIUM 6.9 | 1.2% | – | |
| CVE-2026-42781 | BIG-IP | BIG-IP FastL4 virtual server vulnerability | HIGH 7.1 | 0.27% | – | |
| CVE-2026-42919 | BIG-IP | F5 BIG-IP Appliance Mode Vulnerability | HIGH 7.1 | 0.42% | – | |
| CVE-2026-42920 | BIG-IP | BIG-IP DTLS Vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2026-42924 | BIG-IP | BIG-IP iControl SOAP vulnerability | HIGH 8.5 | 0.41% | – | |
| CVE-2026-42926 | NGINX | NGINX ngx_http_proxy_v2_module vulnerability | MEDIUM 6.3 | 0.34% | – | |
| CVE-2026-42930 | BIG-IP | Appliance mode iControl REST vulnerability | HIGH 8.5 | 0.58% | – | |
| CVE-2026-42934 | NGINX | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.73% | – | |
| CVE-2026-42937 | BIG-IP | iControl REST and tmsh vulnerability | HIGH 7.1 | 0.28% | – | |
| CVE-2026-42945 | NGINX | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 3.4% | – | |
| CVE-2026-42946 | NGINX | NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability | HIGH 8.3 | 0.93% | – | |
| CVE-2026-34176 | BIG-IP | Knowledge Appliance mode iControl REST vulnerability | HIGH 8.5 | 0.90% | – | |
| CVE-2026-27651 | NGINX | NGINX ngx_mail_auth_http_module vulnerability | HIGH 8.7 | 0.94% | – | |
| CVE-2026-27654 | NGINX | NGINX ngx_http_dav_module vulnerability | HIGH 8.8 | 25% | – | |
| CVE-2026-27784 | NGINX | NGINX ngx_http_mp4_module vulnerability | HIGH 8.5 | 1.0% | – | |
| CVE-2026-28753 | NGINX | NGINX ngx_mail_proxy_module vulnerability | MEDIUM 6.3 | 0.26% | – | |
| CVE-2026-28755 | NGINX | NGINX ngx_stream_ssl_module vulnerability | MEDIUM 5.3 | 0.15% | – | |
| CVE-2026-32647 | NGINX | NGINX ngx_http_mp4_module vulnerability | HIGH 8.5 | 0.34% | – | |
| CVE-2026-2507 | BIG-IP | BIG-IP TMM Vulnerability | HIGH 8.7 | 0.30% | – | |
| CVE-2026-1642 | NGINX | NGINX vulnerability | HIGH 8.2 | 0.39% | – | |
| CVE-2026-20730 | BIG-IP | BIG-IP Edge Client for Windows vulnerability | LOW 2 | 0.12% | – | |
| CVE-2026-20732 | BIG-IP | BIG-IP Configuration utility vulnerability | LOW 2.3 | 0.18% | – | |
| CVE-2026-22548 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 8.2 | 0.21% | – | |
| CVE-2026-22549 | BIG-IP | BIG-IP Container Ingress Services vulnerability | MEDIUM 6.9 | 0.36% | – | |
| CVE-2025-14727 | NGINX | NGINX Ingress Controller vulnerability | HIGH 8.7 | 0.43% | – | |
| CVE-2025-53521 | BIG-IP | BIG-IP Stack-Based Buffer Overflow | CRITICAL 9.3 | 2.3% | Yes | |
| CVE-2025-41430 | BIG-IP | BIG-IP SSL Orchestrator vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-46706 | BIG-IP | BIG-IP iRules vulnerability | HIGH 8.7 | 0.43% | – | |
| CVE-2025-47148 | BIG-IP | BIG-IP APM and SSL Orchestrator vulnerability | HIGH 7.1 | 0.39% | – | |
| CVE-2025-47150 | BIG-IQ and F5OS | F5OS SNMP vulnerability | HIGH 7.1 | 0.38% | – | |
| CVE-2025-48008 | BIG-IP | BIG-IP MPTCP vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-53474 | BIG-IP | BIG-IP iRules vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-53856 | BIG-IP | TMM vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-53868 | BIG-IP | BIG-IP SCP and SFTP vulnerability | HIGH 8.5 | 0.44% | – | |
| CVE-2025-54479 | BIG-IP | BIG-IP PEM vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-54755 | BIG-IP | BIG-IP Configuration utility vulnerability | MEDIUM 6.9 | 1.2% | – | |
| CVE-2025-54805 | BIG-IP | TMM Vulnerability | MEDIUM 6 | 0.31% | – | |
| CVE-2025-54854 | BIG-IP | BigIP APM Vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-54858 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-55036 | BIG-IP | BIG-IP SSL Orchestrator vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-55669 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 8.7 | 0.38% | – | |
| CVE-2025-55670 | BIG-IP | BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability | HIGH 7.1 | 0.31% | – | |
| CVE-2025-58096 | BIG-IP | BIG-IP TMM vulnerability | HIGH 8.2 | 0.35% | – | |
| CVE-2025-58120 | BIG-IP | BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-58153 | BIG-IP | BIG-IP HSB vulnerability | HIGH 8.2 | 0.23% | – | |
| CVE-2025-58424 | BIG-IP | BIG-IP TMM vulnerability | MEDIUM 6.3 | 0.25% | – | |
| CVE-2025-58474 | BIG-IP | BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability | MEDIUM 6.9 | 0.39% | – | |
| CVE-2025-59268 | BIG-IP | BIG-IP Configuration utility vulnerability | MEDIUM 6.9 | 0.40% | – | |
| CVE-2025-59269 | BIG-IP | BIG-IP Configuration utility XSS vulnerability | HIGH 8.4 | 0.28% | – | |
| CVE-2025-59478 | BIG-IP | BIG-IP AFM DoS protection profile vulnerability | HIGH 8.7 | 0.37% | – | |
| CVE-2025-59481 | BIG-IP | BIG-IP iControl REST and tmsh vulnerability | HIGH 8.5 | 0.39% | – | |
| CVE-2025-59483 | BIG-IP | BIG-IP Configuration utility and tmsh vulnerability | HIGH 8.5 | 0.37% | – | |
| CVE-2025-59778 | BIG-IQ and F5OS | VELOS partition container network vulnerability | HIGH 7.7 | 0.34% | – | |
| CVE-2025-59781 | BIG-IP | BIG-IP DNS cache vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-60013 | BIG-IQ and F5OS | F5OS-A FIPS HSM password vulnerability | MEDIUM 4.6 | 0.18% | – | |
| CVE-2025-60015 | BIG-IQ and F5OS | F5OS out-of-bounds write vulnerability | MEDIUM 6.9 | 0.21% | – | |
| CVE-2025-60016 | BIG-IP | BIG-IP SSL/TLS vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-61938 | BIG-IP | BIG-IP Advanced WAF and ASM bd process vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-61951 | BIG-IP | BIG-IP DTLS 1.2 Vulnerability | HIGH 8.7 | 0.24% | – | |
| CVE-2025-61955 | BIG-IQ and F5OS | F5OS vulnerability | HIGH 8.5 | 0.25% | – | |
| CVE-2025-61958 | BIG-IP | BIG-IP TMSH vulnerability | HIGH 8.5 | 0.39% | – | |
| CVE-2025-61960 | BIG-IP | BIG-IP APM portal access vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-61974 | BIG-IP | BIG-IP SSL/TLS vulnerability | HIGH 8.7 | 0.46% | – | |
| CVE-2025-53860 | BIG-IQ and F5OS | F5OS-A FIPS HSM vulnerability | MEDIUM 5.6 | 0.12% | – | |
| CVE-2025-57780 | BIG-IQ and F5OS | F5OS Vulnerability | HIGH 8.5 | 0.21% | – | |
| CVE-2025-58071 | BIG-IP | BIG-IP IPSec vulnerability | HIGH 8.7 | 0.37% | – | |
| CVE-2025-61933 | BIG-IP | BIG-IP APM cross-site scripting (XSS) vulnerability | MEDIUM 5.1 | 0.20% | – | |
| CVE-2025-61935 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-61990 | BIG-IP | TMM vulnerability | HIGH 8.7 | 0.35% | – | |
| CVE-2025-46405 | BIG-IP | BIG-IP APM vulnerability | HIGH 8.7 | 0.34% | – | |
| CVE-2025-48500 | BIG-IP | BIG-IP APM VPN web client for macOS vulnerability | HIGH 7 | 0.11% | – | |
| CVE-2025-52585 | BIG-IP | BIG-IP Client SSL profile vulnerability | HIGH 8.7 | 0.34% | – | |
| CVE-2025-53859 | NGINX | NGINX ngx_mail_smtp_module vulnerability | MEDIUM 6.3 | 0.41% | – | |
| CVE-2025-54500 | BIG-IP | HTTP/2 Vulnerability | MEDIUM 6.9 | 0.50% | – | |
| CVE-2025-54809 | Distributed Cloud and other services | F5 Access for Android vulnerability | HIGH 8.8 | 0.25% | – | |
| CVE-2025-31644 | BIG-IP | Appliance mode BIG-IP iControl REST and tmsh vulnerability | HIGH 8.5 | 24% | – | |
| CVE-2025-35995 | BIG-IP | BIG-IP PEM vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-36504 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-36525 | BIG-IP | BIG-IP APM PingAccess Virtual Server Vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-36546 | BIG-IQ and F5OS | F5OS Appliance Mode vulnerability | CRITICAL 9.2 | 0.44% | – | |
| CVE-2025-36557 | BIG-IP | BIG-IP HTTP vulnerability | HIGH 8.7 | 0.43% | – | |
| CVE-2025-41399 | BIG-IP | SCTP Vulnerability | HIGH 8.7 | 0.43% | – | |
| CVE-2025-41414 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 8.7 | 0.43% | – | |
| CVE-2025-41431 | BIG-IP | TMM Vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-41433 | BIG-IP | BIG-IP SIP ALG profile vulnerability | HIGH 8.7 | 0.44% | – | |
| CVE-2025-43878 | BIG-IQ and F5OS | F5OS-A/C CLI vulnerability | HIGH 8.3 | 0.17% | – | |
| CVE-2025-46265 | BIG-IQ and F5OS | F5OS vulnerability | HIGH 8.7 | 0.39% | – | |
| CVE-2025-1695 | NGINX | NGINX Unit Java Vulnerability | MEDIUM 6.9 | 0.59% | – | |
| CVE-2025-20029 | BIG-IP | BIG-IP iControl REST and tmsh vulnerability | HIGH 8.7 | 7.1% | – | |
| CVE-2025-20045 | BIG-IP | BIG-IP SIP MRF Vulnerability | HIGH 8.7 | 0.41% | – | |
| CVE-2025-20058 | BIG-IP | BIG-IP message routing vulnerability | HIGH 8.9 | 0.41% | – | |
| CVE-2025-21087 | BIG-IP | TMM Vulnerability | HIGH 8.9 | 0.41% | – | |
| CVE-2025-21091 | BIG-IP | BIG-IP SNMP vulnerability | HIGH 8.7 | 0.45% | – | |
| CVE-2025-22846 | BIG-IP | BIG-IP SIP Vulnerability | HIGH 8.7 | 0.41% | – | |
| CVE-2025-22891 | BIG-IP | BIG-IP PEM Vulnerability | HIGH 8.7 | 0.41% | – | |
| CVE-2025-23239 | BIG-IP | BIG-IP iControl REST vulnerability | HIGH 8.5 | 0.76% | – | |
| CVE-2025-23412 | BIG-IP | BIG-IP APM access profile vulnerability | HIGH 8.7 | 0.41% | – | |
| CVE-2025-23413 | BIG-IP | BIG-IP Next Central Manager vulnerability | MEDIUM 6.7 | 0.16% | – | |
| CVE-2025-23415 | BIG-IP | BIG-IP APM Endpoint Inspection vulnerability | LOW 2.3 | 0.14% | – | |
| CVE-2025-23419 | NGINX | TLS Session Resumption Vulnerability | MEDIUM 5.3 | 2.8% | – | |
| CVE-2025-24312 | BIG-IP | BIG-IP AFM vulnerability | HIGH 8.7 | 0.40% | – | |
| CVE-2025-24319 | BIG-IP | BIG-IP Next Central Manager vulnerability | HIGH 7.1 | 0.39% | – | |
| CVE-2025-24320 | BIG-IP | BIG-IP Configuration utility vulnerability | MEDIUM 5.1 | 0.43% | – | |
| CVE-2025-24326 | BIG-IP | BIG-IP Advanced WAF/ASM BADoS vulnerability | HIGH 8.9 | 0.41% | – | |
| CVE-2025-24497 | BIG-IP | BIG-IP PEM vulnerability | HIGH 8.7 | 0.41% | – | |
| CVE-2024-10318 | NGINX | NGINX OpenID Connect Vulnerability | MEDIUM 5.1 | 0.35% | – | |
| CVE-2024-45844 | BIG-IP | BIG-IP monitors vulnerability | HIGH 8.6 | 11% | – | |
| CVE-2024-47139 | BIG-IQ and F5OS | F5 BIG-IQ Vulnerability | MEDIUM 4.8 | 0.58% | – | |
| CVE-2024-7634 | NGINX | NGINX Agent Vulnerability | MEDIUM 6.9 | 0.47% | – | |
| CVE-2024-37028 | BIG-IP | BIG-IP Next Central Manager vulnerability | MEDIUM 6.3 | 0.45% | – | |
| CVE-2024-39778 | BIG-IP | BIG-IP HSB vulnerability | HIGH 8.7 | 0.48% | – | |
| CVE-2024-39792 | NGINX | NGINX Plus MQTT vulnerability | HIGH 8.7 | 0.63% | – | |
| CVE-2024-39809 | BIG-IP | BIG-IP Next Central Manager vulnerability | HIGH 8.9 | 0.44% | – | |
| CVE-2024-41164 | BIG-IP | BIG-IP MPTCP vulnerability | HIGH 8.2 | 0.44% | – | |
| CVE-2024-41719 | BIG-IP | BIG-IP Next Central Manager vulnerability | MEDIUM 5.1 | 0.15% | – | |
| CVE-2024-41723 | BIG-IP | BIG-IP iControl REST vulnerability | MEDIUM 5.3 | 0.30% | – | |
| CVE-2024-41727 | BIG-IP | BIG-IP TMM vulnerability | HIGH 8.7 | 0.48% | – | |
| CVE-2024-7347 | NGINX | NGINX MP4 module vulnerability | MEDIUM 5.7 | 0.32% | – | |
| CVE-2024-31079 | NGINX | NGINX HTTP/3 QUIC vulnerability | MEDIUM 4.8 | 0.89% | – | |
| CVE-2024-32760 | NGINX | NGINX HTTP/3 QUIC vulnerability | MEDIUM 6.5 | 0.86% | – | |
| CVE-2024-34161 | NGINX | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.87% | – | |
| CVE-2024-35200 | NGINX | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.93% | – | |
| CVE-2024-21793 | BIG-IP | BIG-IP Central Manager OData Injection Vulnerability | HIGH 7.5 | 7.1% | – | |
| CVE-2024-25560 | BIG-IP | TMM Vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-26026 | BIG-IP | BIG-IP Central Manager SQL Injection | HIGH 7.5 | 7.2% | – | |
| CVE-2024-27202 | BIG-IP | BIG-IP TMUI XSS vulnerability | MEDIUM 4.7 | 0.27% | – | |
| CVE-2024-28132 | BIG-IP | BIG-IP NEXT CNF vulnerability | MEDIUM 4.4 | 0.17% | – | |
| CVE-2024-28883 | BIG-IP | BIG-IP APM browser network access VPN client vulnerability | HIGH 7.4 | 0.21% | – | |
| CVE-2024-28889 | BIG-IP | BIG-IP SSL vulnerability | MEDIUM 5.9 | 0.44% | – | |
| CVE-2024-31156 | BIG-IP | BIG-IP Configuration utility XSS vulnerability | HIGH 8 | 0.58% | – | |
| CVE-2024-32049 | BIG-IP | BIG-IP Next Central Manager vulnerability | HIGH 7.4 | 0.55% | – | |
| CVE-2024-32761 | BIG-IP | BIG-IP TMM tenants on VELOS and rSeries vulnerability | MEDIUM 6.5 | 0.46% | – | |
| CVE-2024-33604 | BIG-IP | BIG-IP Configuration utility XSS vulnerability | MEDIUM 6.1 | 0.31% | – | |
| CVE-2024-33608 | BIG-IP | BIG-IP IPsec vulnerability | HIGH 7.5 | 0.59% | – | |
| CVE-2024-33612 | BIG-IP | BIG-IP Next Central Manager vulnerability | MEDIUM 6.8 | 0.23% | – | |
| CVE-2024-21763 | BIG-IP | BIG-IP AFM vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-21771 | BIG-IP | F5 AFM Signature Matching Vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-21782 | BIG-IP | BIG-IP and BIG-IQ secure copy vulnerability | MEDIUM 6.7 | 0.18% | – | |
| CVE-2024-21789 | BIG-IP | BIG-IP ASM and Advanced WAF vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-21849 | BIG-IP | BIG-IP Websockets vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-22093 | BIG-IP | Appliance mode iControl REST vulnerability | HIGH 8.7 | 0.83% | – | |
| CVE-2024-22389 | BIG-IP | BIG-IP iControl REST API Vulnerability | HIGH 7.2 | 0.50% | – | |
| CVE-2024-23306 | BIG-IP | BIG-IP Next CNF & SPK vulnerability | HIGH 7.1 | 0.15% | – | |
| CVE-2024-23308 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-23314 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-23603 | BIG-IP | BIG-IP Advanced WAF and ASM Configuration utility vulnerability | LOW 3.8 | 0.30% | – | |
| CVE-2024-23607 | BIG-IQ and F5OS | F5OS QKView utility vulnerability | MEDIUM 5.5 | 0.50% | – | |
| CVE-2024-23976 | BIG-IP | BIG-IP Appliance mode iAppsLX vulnerability | MEDIUM 6 | 0.17% | – | |
| CVE-2024-23979 | BIG-IP | BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability | HIGH 7.5 | 0.34% | – | |
| CVE-2024-24775 | BIG-IP | BIG-IP TMM vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2024-24966 | BIG-IQ and F5OS | F5OS vulnerability | MEDIUM 6.2 | 0.20% | – | |
| CVE-2024-24989 | NGINX | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 1.1% | – | |
| CVE-2024-24990 | NGINX | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 0.91% | – | |
| CVE-2024-23805 | BIG-IP | F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability | HIGH 7.5 | 0.52% | – | |
| CVE-2023-46748 | BIG-IP | BIG-IP Configuration utility authenticated SQL injection vulnerability | HIGH 8.8 | 4.5% | Yes | |
| CVE-2023-46747 | BIG-IP | BIG-IP Configuration utility unauthenticated remote code execution vulnerability | CRITICAL 9.8 | 97% | Yes · ransomware | |
| CVE-2023-3470 | BIG-IP | BIG-IP FIPS HSM password vulnerability CVE-2023-3470 | MEDIUM 6 | 0.18% | – | |
| CVE-2023-39447 | BIG-IP | BIG-IP APM Guided Configuration vulnerability | MEDIUM 4.4 | 0.19% | – | |
| CVE-2023-40534 | BIG-IP | BIG-IP HTTP/2 vulnerability | HIGH 7.5 | 0.65% | – | |
| CVE-2023-40537 | BIG-IP | Multi-blade VIPRION Configuration utility session cookie vulnerability | HIGH 8.1 | 0.55% | – | |
| CVE-2023-40542 | BIG-IP | BIG-IP TCP Profile vulnerability | HIGH 7.5 | 0.65% | – | |
| CVE-2023-41085 | BIG-IP | BIG-IP IPSEC vulnerability | HIGH 7.5 | 0.62% | – | |
| CVE-2023-41253 | BIG-IP | BIG-IP DNS TSIG Key vulnerability | MEDIUM 5.5 | 0.18% | – | |
| CVE-2023-41373 | BIG-IP | BIG-IP Configuration Utility vulnerability | HIGH 8.8 | 2.3% | – | |
| CVE-2023-41964 | BIG-IP | BIG-IP and BIG-IQ Database Variable vulnerability | MEDIUM 4.3 | 0.30% | – | |
| CVE-2023-42768 | BIG-IP | BIG-IP iControl REST vulnerability | HIGH 7.2 | 0.65% | – | |
| CVE-2023-43485 | BIG-IP | BIGIP and BIG-IQ TACACS+ audit log Vulnerability | MEDIUM 5.5 | 0.18% | – | |
| CVE-2023-43611 | BIG-IP | BIG-IP Edge Client for macOS vulnerability | HIGH 7.8 | 0.16% | – | |
| CVE-2023-43746 | BIG-IP | BIG-IP Appliance mode external monitor vulnerability | HIGH 8.7 | 0.53% | – | |
| CVE-2023-45219 | BIG-IP | BIG-IP tmsh vulnerability | MEDIUM 4.4 | 0.19% | – | |
| CVE-2023-45226 | BIG-IP | BIG-IP Next SPK SSH vulnerability | HIGH 7.4 | 0.46% | – | |
| CVE-2023-43124 | BIG-IP | BIG-IP APM Clients TunnelCrack vulnerability | MEDIUM 5.3 | 0.17% | – | |
| CVE-2023-43125 | BIG-IP | BIG-IP APM Clients TunnelCrack vulnerability | MEDIUM 6.8 | 0.28% | – | |
| CVE-2023-36494 | BIG-IQ and F5OS | F5OS-A vulnerability | MEDIUM 4.4 | 0.19% | – | |
| CVE-2023-36858 | BIG-IP | BIG-IP Edge Client for Windows and macOS vulnerability | HIGH 7.1 | 0.14% | – | |
| CVE-2023-38138 | BIG-IP | BIG-IP Configuration utility vulnerability | HIGH 7.5 | 0.39% | – | |
| CVE-2023-38419 | BIG-IP | BIG-IP and BIG-IQ iControl SOAP vulnerability | MEDIUM 4.3 | 0.55% | – | |
| CVE-2023-38423 | BIG-IP | BIG-IP Configuration utility vulnerability | MEDIUM 5.4 | 0.34% | – | |
| CVE-2023-5450 | BIG-IP | BIG-IP Edge Client for macOS vulnerability | HIGH 7.3 | 0.15% | – | |
| CVE-2023-22372 | BIG-IP | BIG-IP Edge Client for Windows and Mac OS vulnerability | MEDIUM 5.9 | 0.22% | – | |
| CVE-2023-24461 | BIG-IP | BIG-IP Edge Client for Windows and macOS vulnerability | HIGH 7.4 | 0.29% | – | |
| CVE-2023-24594 | BIG-IP | BIG-IP TMM SSL vulnerability | MEDIUM 5.3 | 0.56% | – | |
| CVE-2023-27378 | BIG-IP | BIG-IP TMUI XSS vulnerability | HIGH 7.5 | 0.39% | – | |
| CVE-2023-28406 | BIG-IP | BIG-IP Configuration utility vulnerability | MEDIUM 4.3 | 1.2% | – | |
| CVE-2023-28656 | NGINX | NGINX Management Suite vulnerability | HIGH 8.1 | 0.53% | – | |
| CVE-2023-28724 | NGINX | NGINX Management Suite vulnerability | HIGH 7.1 | 0.17% | – | |
| CVE-2023-28742 | BIG-IP | BIG-IP iQuery mesh vulnerability | HIGH 7.2 | 1.5% | – | |
| CVE-2023-29163 | BIG-IP | BIG-IP UDP Profile vulnerability | HIGH 7.5 | 0.62% | – | |
| CVE-2023-29240 | BIG-IQ and F5OS | BIG-IQ iControl REST Vulnerability | MEDIUM 5.4 | 0.40% | – | |
| CVE-2023-1550 | NGINX | NGINX Agent vulnerability CVE-2023-1550 | MEDIUM 5.5 | 0.22% | – | |
| CVE-2023-22281 | BIG-IP | BIG-IP AFM vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22302 | BIG-IP | BIG-IP HTTP profile vulnerability | MEDIUM 5.9 | 0.53% | – | |
| CVE-2023-22323 | BIG-IP | BIG-IP SSL OCSP Authentication profile vulnerability | HIGH 7.5 | 0.66% | – | |
| CVE-2023-22326 | BIG-IP | iControl REST and tmsh vulnerability | MEDIUM 4.9 | 0.52% | – | |
| CVE-2023-22340 | BIG-IP | BIG-IP SIP profile vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22341 | BIG-IP | BIG-IP APM OAuth vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22374 | BIG-IP | iControl SOAP vulnerability | HIGH 7.5 | 73% | – | |
| CVE-2023-22418 | BIG-IP | BIG-IP APM virtual server vulnerability | MEDIUM 6.1 | 0.35% | – | |
| CVE-2023-22422 | BIG-IP | HTTP profile vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22657 | BIG-IQ and F5OS | F5OS vulnerability | HIGH 7 | 0.44% | – | |
| CVE-2023-22664 | BIG-IP | BIG-IP HTTP/2 profile vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22839 | BIG-IP | BIG-IP DNS profile vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22842 | BIG-IP | BIG-IP SIP profile vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-23552 | BIG-IP | BIG-IP Advanced WAF and ASM vulnerability | HIGH 7.5 | 1.5% | – | |
| CVE-2023-23555 | BIG-IP | BIG-IP Virtual Edition vulnerability | HIGH 7.5 | 0.63% | – | |
| CVE-2023-22283 | BIG-IP | BIG-IP Edge Client for Windows vulnerability | MEDIUM 6.5 | 0.20% | – | |
| CVE-2023-22358 | BIG-IP | BIG-IP Edge Client for Windows vulnerability | HIGH 7.8 | 0.22% | – | |
| CVE-2023-38418 | BIG-IP | BIG-IP Edge Client for macOS vulnerability | HIGH 7.8 | 0.14% | – | |
| CVE-2026-66362 | NGINX | NGF vulnerability | HIGH 8.6 | 0.57% | – | |
| CVE-2026-78689 | NGINX | NGINX ngx_http_js_module vulnerablility | CRITICAL 9.2 | 0.76% | – | |
| CVE-2022-1388 | BIG-IP | BIG-IP Missing Authentication | CRITICAL 9.8 | 100% | Yes · ransomware | |
| CVE-2021-22991 | BIG-IP | BIG-IP Traffic Management Microkernel Buffer Overflow | CRITICAL 9.8 | 61% | Yes | |
| CVE-2021-22986 | BIG-IP | BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution | CRITICAL 9.8 | 100% | Yes · ransomware | |
| CVE-2020-5902 | BIG-IP | BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution | CRITICAL 9.8 | 100% | Yes · ransomware |
Sources: F5 security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.