Skip to content
OpenAdvisories

Vendor

F5

432 known vulnerabilities.

Products

BIG-IP 259 NGINX Plus 37 NGINX Open Source 35 BIG-IP Next CNF 26 BIG-IP Next SPK 23 BIG-IQ 20 BIG-IP Next for Kubernetes 13 BIG-IP APM 12 F5OS - Appliance 12 BIG-IP Edge Client 11 F5OS - Chassis 10 BIG-IP Next Central Manager 9 NGINX Ingress Controller 8 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 8 BIG-IQ Centralized Management 7 NGINX JavaScript 6 NGINX Gateway Fabric 6 NGINX Instance Manager 5 BIG-IP ASM 4 BIG-IP Next 4 BIG-IP (AFM) 4 BIG-IP Guided Configuration (GC) 4 F5OS-A 4 NGINX Agent 3 BIG-IP Advanced WAF & ASM 3 F5 Access 3 SSL Orchestrator 3 BIG-IP SPK 3 BIG-IP APM Clients 3 NGINX API Connectivity Manager 3 F5OS-C 3 BIG-IP DNS 2 APM Clients 2 NGINX 2 NGINX Open Source Subscription 2 BIG-IP (AFM, PEM) 2 F5 SSL Orchestrator 2 Traffix SDC 2 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager 2 BIG-IP (Advanced WAF, APM, ASM) 2
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-63020

    BIG-IP Configuration utility vulnerability

    A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the v…

    F5 BIG-IP Network devices
  • Low 3.7
    CVE-2026-60065

    NGINX Plus ngx_stream_mqtt_filter_module vulnerability

    When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in th…

    F5 NGINX Plus Network devices
  • Low 3.7
    CVE-2026-28753

    NGINX ngx_mail_proxy_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, le…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-20732

    BIG-IP Configuration utility vulnerability

    A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • Low 3.3
    CVE-2026-20730

    BIG-IP Edge Client for Windows vulnerability

    A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    F5 BIG-IP Edge Client Network devices Browsers
  • Low 3.7
    CVE-2025-53859

    NGINX ngx_mail_smtp_module vulnerability

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to th…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Alpine
  • Low 3.1
    CVE-2025-23415

    BIG-IP APM Endpoint Inspection vulnerability

    An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN clie…

    F5 BIG-IP Network devices
  • Low 3.8
    CVE-2024-23603

    BIG-IP Advanced WAF and ASM Configuration utility vulnerability

    An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    F5 BIG-IP Network devices
  • Low 3.7
    CVE-2022-41983

    BIG-IP TMM Vulnerability CVE-2022-41983

    On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can caus…

    F5 BIG-IP Network devices
  • Low 3.7
    CVE-2022-33968

    BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed…

    F5 BIG-IP Network devices
  • Low 3.1
    CVE-2022-1389

    On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site requ…

    F5 BIG-IP Network devices