Browse All CVEs
33,201 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-32643 |
high | 8.5 | 0.0016 | 2026-10-29 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticat | |
CVE-2026-32673 |
high | 8.5 | 0.0024 | 2026-10-29 | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacke | |
CVE-2026-34019 |
medium | 6.3 | 0.0029 | 2026-10-29 | When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing | |
CVE-2026-34176 |
high | 8.5 | 0.0069 | 2026-10-29 | When running in Appliance mode, an authenticated remote command injection vulnerability ex | |
CVE-2026-35062 |
high | 7.1 | 0.0025 | 2026-10-29 | An authenticated iControl SOAP user may be able to obtain information of other accounts. | |
CVE-2026-39455 |
high | 8.7 | 0.0030 | 2026-10-29 | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Pr | |
CVE-2026-39458 |
high | 8.7 | 0.0026 | 2026-10-29 | When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, | |
CVE-2026-39459 |
high | 8.6 | 0.0026 | 2026-10-29 | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privilege | |
CVE-2026-40060 |
high | 8.7 | 0.0032 | 2026-10-29 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undis | |
CVE-2026-40061 |
high | 8.5 | 0.0024 | 2026-10-29 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and | |
CVE-2026-40067 |
high | 8.7 | 0.0032 | 2026-10-29 | When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can | |
CVE-2026-40423 |
high | 8.7 | 0.0026 | 2026-10-29 | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Tr | |
CVE-2026-40435 |
medium | 6.9 | 0.0023 | 2026-10-29 | When configured, IP-based access restrictions for httpd do not cover all endpoints, which | |
CVE-2026-40460 |
medium | 6.9 | 0.0037 | 2026-10-29 | When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an atta | |
CVE-2026-40462 |
high | 7.1 | 0.0025 | 2026-10-29 | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tms | |
CVE-2026-40618 |
high | 8.7 | 0.0032 | 2026-10-29 | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) witho | |
CVE-2026-40629 |
high | 8.7 | 0.0032 | 2026-10-29 | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the vi | |
CVE-2026-40631 |
high | 8.5 | 0.0025 | 2026-10-29 | An authenticated attacker with the Resource Administrator or Administrator role can modify | |
CVE-2026-40698 |
high | 8.5 | 0.0024 | 2026-10-29 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticat | |
CVE-2026-40699 |
high | 7.1 | 0.0028 | 2026-10-29 | A vulnerability exists in the undisclosed pages in the Configuration utility that may allo | |
CVE-2026-40701 |
medium | 6.3 | 0.0069 | 2026-10-29 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module wh | |
CVE-2026-40703 |
medium | 5.3 | 0.0010 | 2026-10-29 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Co | |
CVE-2026-41217 |
high | 8.3 | 0.0011 | 2026-10-29 | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow a | |
CVE-2026-41218 |
high | 8.7 | 0.0026 | 2026-10-29 | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting | |
CVE-2026-41219 |
high | 7.1 | 0.0028 | 2026-10-29 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a l | |
CVE-2026-41225 |
high | 8.6 | 0.0027 | 2026-10-29 | A vulnerability exists in iControl REST where a highly privileged, authenticated attacker | |
CVE-2026-41227 |
high | 8.7 | 0.0026 | 2026-10-29 | On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic ca | |
CVE-2026-41953 |
high | 8.5 | 0.0025 | 2026-10-29 | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker | |
CVE-2026-41954 |
medium | 6.9 | 0.0029 | 2026-10-29 | Sensitive information disclosure vulnerability exists in the undisclosed iControl REST end | |
CVE-2026-41956 |
high | 8.7 | 0.0026 | 2026-10-29 | When a classification profile is configured on a UDP virtual server, undisclosed requests | |
CVE-2026-41957 |
high | 8.7 | 0.0051 | 2026-10-29 | An authenticated remote code execution vulnerability through undisclosed vectors exists in | |
CVE-2026-41959 |
high | 7.1 | 0.0020 | 2026-10-29 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tms | |
CVE-2026-42058 |
medium | 5.3 | 0.0019 | 2026-10-29 | An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an in | |
CVE-2026-42063 |
medium | 6.9 | 0.0029 | 2026-10-29 | A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource | |
CVE-2026-42406 |
high | 8.5 | 0.0015 | 2026-10-29 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticat | |
CVE-2026-42408 |
medium | 6.7 | 0.0008 | 2026-10-29 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) | |
CVE-2026-42409 |
high | 8.7 | 0.0026 | 2026-10-29 | When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command | |
CVE-2026-42557 |
high | 8.6 | 0.0037 | 2026-10-29 | jupyterlab is an extensible environment for interactive and reproducible computing, based | |
CVE-2026-42780 |
medium | 6.9 | 0.0089 | 2026-10-29 | A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authe | |
CVE-2026-42781 |
high | 7.1 | 0.0018 | 2026-10-29 | When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed | |
CVE-2026-42919 |
high | 7.1 | 0.0029 | 2026-10-29 | A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with adm | |
CVE-2026-42920 |
high | 8.7 | 0.0026 | 2026-10-29 | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual | |
CVE-2026-42924 |
high | 8.5 | 0.0025 | 2026-10-29 | An authenticated attacker with the Resource Administrator or Administrator role can create | |
CVE-2026-42926 |
medium | 6.3 | 0.0035 | 2026-10-29 | When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version | |
CVE-2026-42930 |
high | 8.5 | 0.0048 | 2026-10-29 | When running in Appliance mode, an authenticated attacker assigned the 'Administrator' rol | |
CVE-2026-42934 |
medium | 6.3 | 0.0073 | 2026-10-29 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module modul | |
CVE-2026-42937 |
high | 7.1 | 0.0020 | 2026-10-29 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tms | |
CVE-2026-42945 |
critical | 9.2 | 0.6805 | 2026-10-29 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module modul | |
CVE-2026-42946 |
high | 8.3 | 0.0093 | 2026-10-29 | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that | |
CVE-2026-44455 |
medium | 6.1 | 0.0014 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio |