Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-41219 |
high | 7.1 | 0.0028 | 2026-10-29 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a l | |
CVE-2026-41218 |
high | 8.7 | 0.0026 | 2026-10-29 | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting | |
CVE-2026-41217 |
high | 8.3 | 0.0011 | 2026-10-29 | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow a | |
CVE-2026-40703 |
medium | 5.3 | 0.0010 | 2026-10-29 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Co | |
CVE-2026-40701 |
medium | 6.3 | 0.0069 | 2026-10-29 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module wh | |
CVE-2026-40699 |
high | 7.1 | 0.0028 | 2026-10-29 | A vulnerability exists in the undisclosed pages in the Configuration utility that may allo | |
CVE-2026-40698 |
high | 8.5 | 0.0024 | 2026-10-29 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticat | |
CVE-2026-40631 |
high | 8.5 | 0.0025 | 2026-10-29 | An authenticated attacker with the Resource Administrator or Administrator role can modify | |
CVE-2026-40629 |
high | 8.7 | 0.0032 | 2026-10-29 | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the vi | |
CVE-2026-40618 |
high | 8.7 | 0.0032 | 2026-10-29 | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) witho | |
CVE-2026-40462 |
high | 7.1 | 0.0025 | 2026-10-29 | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tms | |
CVE-2026-40460 |
medium | 6.9 | 0.0037 | 2026-10-29 | When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an atta | |
CVE-2026-40435 |
medium | 6.9 | 0.0023 | 2026-10-29 | When configured, IP-based access restrictions for httpd do not cover all endpoints, which | |
CVE-2026-40423 |
high | 8.7 | 0.0026 | 2026-10-29 | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Tr | |
CVE-2026-40067 |
high | 8.7 | 0.0032 | 2026-10-29 | When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can | |
CVE-2026-40061 |
high | 8.5 | 0.0024 | 2026-10-29 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and | |
CVE-2026-40060 |
high | 8.7 | 0.0032 | 2026-10-29 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undis | |
CVE-2026-39459 |
high | 8.6 | 0.0026 | 2026-10-29 | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privilege | |
CVE-2026-39458 |
high | 8.7 | 0.0026 | 2026-10-29 | When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, | |
CVE-2026-39455 |
high | 8.7 | 0.0030 | 2026-10-29 | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Pr | |
CVE-2026-35062 |
high | 7.1 | 0.0025 | 2026-10-29 | An authenticated iControl SOAP user may be able to obtain information of other accounts. | |
CVE-2026-34176 |
high | 8.5 | 0.0069 | 2026-10-29 | When running in Appliance mode, an authenticated remote command injection vulnerability ex | |
CVE-2026-34019 |
medium | 6.3 | 0.0029 | 2026-10-29 | When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing | |
CVE-2026-32673 |
high | 8.5 | 0.0024 | 2026-10-29 | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacke | |
CVE-2026-32643 |
high | 8.5 | 0.0016 | 2026-10-29 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticat | |
CVE-2026-28758 |
medium | 6.7 | 0.0008 | 2026-10-29 | When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iContr | |
CVE-2026-24464 |
medium | 6.9 | 0.0089 | 2026-10-29 | When running in Appliance mode, a directory traversal vulnerability exists in an undisclos | |
CVE-2026-20916 |
high | 7.2 | 0.0037 | 2026-10-29 | An authenticated iControl REST user with low privileges can create or modify arbitrary fil | |
CVE-2025-29338 |
medium | 5.6 | 0.0018 | 2026-10-29 | NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 wa | |
CVE-2025-28344 |
high | 7.5 | 0.0033 | 2026-10-29 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack. | |
CVE-2025-28343 |
high | 7.5 | 0.0038 | 2026-10-29 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadBut | |
CVE-2024-55045 |
high | 7.3 | 0.0027 | 2026-10-29 | Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow | |
CVE-2024-51395 |
medium | 6.2 | 0.0011 | 2026-10-29 | Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37 | |
CVE-2024-51394 |
medium | 5.5 | 0.0010 | 2026-10-29 | Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37 | |
CVE-2026-8463 |
medium | 5.3 | 0.0033 | 2026-10-29 | Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read | |
CVE-2026-39806 |
high | 8.7 | 0.0064 | 2026-10-29 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit all | |
CVE-2026-39803 |
high | 8.7 | 0.0064 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allow | |
CVE-2026-42961 |
medium | 5.1 | 0.0019 | 2026-10-29 | ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with ina | |
CVE-2026-42950 |
medium | 5.1 | 0.0021 | 2026-10-29 | ELECOM wireless LAN access point devices do not check if language parameter has an appropr | |
CVE-2026-42948 |
medium | 4.8 | 0.0016 | 2026-10-29 | Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devic | |
CVE-2026-42062 |
critical | 9.3 | 0.0163 | 2026-10-29 | ELECOM wireless LAN access point devices contain an OS command injection in processing of | |
CVE-2026-40621 |
critical | 9.3 | 0.0049 | 2026-10-29 | ELECOM wireless LAN access point devices do not require authentication to access some spec | |
CVE-2026-35506 |
high | 8.6 | 0.0131 | 2026-10-29 | ELECOM wireless LAN access point devices contain an OS command injection vulnerability in | |
CVE-2026-25107 |
medium | 6.9 | 0.0012 | 2026-10-29 | ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating | |
CVE-2026-44931 |
medium | 5.1 | 0.0015 | 2026-10-29 | The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/ma | |
CVE-2026-41051 |
medium | 5.1 | 0.0008 | 2026-10-29 | csync2 uses insecure temporary directories when compiled with C99 or later, allowing for T | |
CVE-2026-25710 |
high | 7.0 | 0.0013 | 2026-10-29 | The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffe | |
CVE-2024-47091 |
medium | 5.2 | 0.0012 | 2026-10-29 | Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p | |
CVE-2026-41050 |
critical | 9.9 | 0.0039 | 2026-10-29 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, | |
CVE-2026-25705 |
high | 8.4 | 0.0037 | 2026-10-29 | A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs. |