CVE Program partner

F5

F5, Inc.

API
CVEs, 365 days100984 all time, 148 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationF5, Inc.
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeAll F5 products and services, commercial and open source, which have not yet reached End of Technical Support (EoTS). All legacy acquisition products and brands including, but not limited to, NGINX, Shape Security, Volterra, and Threat Stack. F5 does not issue CVEs for products which are no longer supported.
Advisorieshttps://my.f5.com/manage/s/new-updated-articles#sort=%40f5_updated_published_date%20descending&f:@f5_document_type=[Security%20Advisory]&periodFilter=4&dateField=0

Latest CVEs · RSS

  • CVE-2026-104939 2026-10-14 · CVSS 7.5
    Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP r
  • CVE-2026-101019 2026-10-14 · CVSS 6.5
    Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalizatio
  • CVE-2026-101025 2026-10-14 · CVSS 5.3
    Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path d
  • CVE-2026-95101 2026-10-14 · CVSS 5.3
    Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directiv
  • CVE-2026-94197 2026-10-14 · CVSS 7.5
    An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy o
  • CVE-2026-96615 2026-10-14 · CVSS 6.5
    Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connec
  • CVE-2026-91184 2026-10-14 · CVSS 8.8
    Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verba
  • CVE-2026-97205 2026-10-14 · CVSS 8.1
    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations,
  • CVE-2026-93479 2026-10-14 · CVSS 8.1
    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the m
  • CVE-2026-97629 2026-10-14 · CVSS 6.5
    Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file direct
  • CVE-2026-15176 2026-10-14 · CVSS 8.1
    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return
  • CVE-2026-94127 2026-09-22 · CVSS 9.8
    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). Thi
  • CVE-2026-90439 2026-09-15 · CVSS 6.5
    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain c
  • CVE-2026-78222 2026-09-02 · CVSS 7.5
    A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Respo
  • CVE-2026-78689 2026-09-02 · CVSS 8.1
    Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An
  • CVE-2026-77180 2026-09-02 · CVSS 8.3
    When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controll
  • CVE-2026-66362 2026-09-02 · CVSS 8.1
    Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator co
  • CVE-2026-18329 2026-09-02 · CVSS 8.2
    Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an
  • CVE-2026-66842 2026-09-02 · CVSS 8.8
    BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic
  • CVE-2026-63020 2026-09-02 · CVSS 3.1
    A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may tr
  • CVE-2026-60005 2026-07-15 · CVSS 8.2
    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or
  • CVE-2026-60065 2026-07-15 · CVSS 3.7
    When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can
  • CVE-2026-56434 2026-07-15 · CVSS 6.5
    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy
  • CVE-2026-42533 2026-07-15 · CVSS 8.1
    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture v
  • CVE-2026-60062 2026-07-15 · CVSS 6.4
    The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory

All CVE Program partners