Known vulnerabilities in BIG-IP - page 2

Software: BIG-IP
Software CPE: cpe:2.3:h:f5_networks:big-ip:*:*:*:*:*:*:*:*
Total vulnerabilities: 380
Public exploits: 33
Known exploited (KEV): 9
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting BIG-IP BIG-IP is affected by 380 known vulnerabilities: 2 critical, 19 high, 216 medium, 143 low Critical High Medium Low

Vulnerabilities (380)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131395 - Information Exposure Through Log Files
CVE-2026-41219
CWE-532 Low
No
No
17.1.3.1, 17.5.1.4 14.05.2026 SB2026051428
#VU131394 - Incorrect Calculation of Buffer Size
CVE-2026-40618
CWE-131 Medium
No
No
17.1.3.1, 17.5.1.4, 21.0.0.1 14.05.2026 SB2026051425
SB2026051426
SB2026051427
#VU131393 - Improper Neutralization of Data within XPath Expressions
CVE-2026-40699
CWE-643 Low
No
No
17.1.3, 17.5.0 14.05.2026 SB2026051421
#VU131392 - Incorrect Permission Assignment for Critical Resource
CVE-2026-41217
CWE-732 Low
No
No
17.1.3.2, 17.5.1.6, 21.0.0.2 14.05.2026 SB2026051422
#VU131391 - NULL Pointer Dereference
CVE-2026-42409
CWE-476 Medium
No
No
17.1.3.1, 17.5.1.4, 21.0.0.1 14.05.2026 SB2026051423
#VU131390 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-42781
CWE-835 Medium
No
No
17.1.3.1, 17.5.1.4, 21.0.0.1 14.05.2026 SB2026051424
#VU124687 - Improper input validation
CVE-2025-53521
CWE-20 Critical
No
Exploited
15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3 30.03.2026 SB2025101655
#VU122365 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2026-20732
CWE-451 Medium
No
No
17.1.3.1, 17.5.1.4 05.02.2026 SB2026020535
#VU122359 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-22548
CWE-362 Medium
No
No
17.1.3 05.02.2026 SB2026020531
#VU117359 - Incomplete cleanup
CVE-2025-59781
CWE-459 Medium
No
No
15.1.10.8, 16.1.6, 17.1.2.2 17.10.2025 SB2025101759
#VU114086 - Resource exhaustion
CVE-2025-54500
CWE-400 Medium
No
No
16.1.6.0.27.3, 17.1.2.2.0.259.12, 17.5.1.0.80.7 14.08.2025 SB2025081450
SB2025081451
SB2025081452
#VU114083 - NULL Pointer Dereference
CVE-2025-52585
CWE-476 Medium
No
No
16.1.6, 17.1.2.2 14.08.2025 SB2025081428
#VU112734 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2024-42516
CWE-113 Low
No
No
- 10.07.2025 -
#VU107793 - Memory corruption
CVE-2025-22026
CWE-119 Low
No
No
- 22.04.2025 -
#VU88151 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2023-38709
CWE-113 Medium
No
No
- 04.04.2024 -
#VU86707 - Server-Side Request Forgery (SSRF)
CVE-2024-24806
CWE-918 Medium
No
No
- 22.02.2024 -
#VU31958 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2019-18348
CWE-74 Medium
No
No
- 23.10.2019 -
#VU18829 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-9740
CWE-93 Medium
No
No
17.1.2.1, 17.5.1 19.06.2019 SB2019031318
SB2019062812
SB2019072603
and 32 more
#VU18828 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2019-9947
CWE-93 Medium
No
No
- 19.06.2019 -
#VU17105 - Improper input validation
CVE-2016-10739
CWE-20 Low
No
No
- 22.01.2019 -


Showing elements 21 - 40 out of 380