F5
Number 44 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
432
Critical
4
High
212
Known Exploited
5
Exploit available
1
Network, no login needed
57.6%
Of 368 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 99 | 1 | 52 | 41 | 5 | 0 |
| 2025 | 81 | 1 | 57 | 21 | 2 | 0 |
| 2024 | 50 | 0 | 27 | 22 | 1 | 0 |
| 2023 | 54 | 1 | 33 | 20 | 0 | 0 |
| 2022 | 84 | 1 | 43 | 37 | 3 | 0 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 5 | 0 | 0 | 0 | 0 | 5 |
| 2019 | 59 | 0 | 0 | 0 | 0 | 59 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| BIG-IP | 257 | 143 |
| NGINX Plus | 21 | 11 |
| NGINX Open Source | 17 | 6 |
| BIG-IP APM | 12 | 5 |
| F5OS - Appliance | 12 | 4 |
| BIG-IP Edge Client | 11 | 7 |
| BIG-IP Next Central Manager | 9 | 4 |
| BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 8 | 0 |
| NGINX Ingress Controller | 7 | 5 |
| NGINX Gateway Fabric | 6 | 4 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 76 | 61 |
| Denial of Service | 19 | 12 |
| Command Injection | 18 | 15 |
| Allocation of Resources Without Limits or Throttling | 16 | 13 |
| Information Disclosure | 16 | 0 |
| Cross-Site Scripting | 14 | 7 |
| Path Traversal | 14 | 3 |
| Improper Input Validation | 11 | 2 |
| Missing Release of Memory after Effective Lifetime | 9 | 6 |
| Incorrect Permission Assignment for Critical Resource | 8 | 1 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-94127 | BIG-IP APM OAuth vulnerability | Critical | 26.6% | |
| CVE-2025-53521 | BigIP APM Vulnerability | Critical | 2.3% | |
| CVE-2023-46748 | BIG-IP Configuration utility authenticated SQL injection vulnerability | High | 4.3% | |
| CVE-2023-46747 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability | Critical | 96.7% | |
| CVE-2022-1388 | F5 BIG-IP: Authentication Issues | Critical | 100.0% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-97629 | NGINX ngx_http_ssl_module vulnerability | Medium | 0.2% | |
| CVE-2026-97205 | NGINX ngx_http_core_module vulnerability | High | 0.8% | |
| CVE-2026-96615 | NGINX Gateway Fabric vulnerability | Medium | 0.3% | |
| CVE-2026-95101 | NGINX ngx_http_v3_module vulnerability | Medium | 0.3% | |
| CVE-2026-94197 | NGINX Ingress Controller vulnerability | High | 0.4% | |
| CVE-2026-93479 | NGINX map directive and regex matching vulnerability | High | 1.2% | |
| CVE-2026-91184 | NGINX Gateway Fabric vulnerability | High | 0.5% | |
| CVE-2026-15176 | NGINX ngx_http_core_module vulnerability | High | 1.0% | |
| CVE-2026-104939 | NGINX Ingress Controller vulnerability | High | 0.4% | |
| CVE-2026-101025 | NGINX ngx_http_js_module vulnerability | Medium | 0.3% |