Known vulnerabilities in NGINX Plus R30 P1
Vendor:
F5 Networks
Software:
NGINX Plus
Version:
R30 P1
Software CPE:
cpe:2.3:a:f5_networks:nginx_plus:*:*:*:*:*:*:*:*
Website:
https://f5.com/
Total vulnerabilities:
20
Public exploits:
2
Known exploited (KEV):
1
Highest CVSSv4 Score:
9.2
Vulnerabilities by Severity
Vulnerabilities (20)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU134864 - Out-of-bounds read CVE-2026-48142 |
CWE-125 | Medium | R36 P6, 37.0.2.1 | 18.06.2026 |
SB2026061844 SB2026061845 SB2026061846 and 10 more |
||
| #VU132220 - Heap-based Buffer Overflow CVE-2026-9256 |
CWE-122 | Critical | R32 P7, R36 P5, 37.0.1.1 | 25.05.2026 |
SB2026052502 SB2026052504 SB2026052505 and 12 more |
||
| #VU131379 - Use After Free CVE-2026-40701 |
CWE-416 | Medium | R32 P6, R36 P4 | 14.05.2026 |
SB2026051401 SB2026051497 SB2026051498 and 12 more |
||
| #VU131377 - Heap-based Buffer Overflow CVE-2026-42945 |
CWE-122 | Critical | R32 P6, R36 P4 | 14.05.2026 |
SB2026051401 SB2026051497 SB2026051498 and 26 more |
||
| #VU131375 - Uncontrolled Memory Allocation CVE-2026-42946 |
CWE-789 | Medium | R32 P6, R36 P4 | 14.05.2026 |
SB2026051401 SB2026051497 SB2026051498 and 14 more |
||
| #VU131374 - Out-of-bounds read CVE-2026-42934 |
CWE-125 | Medium | R32 P6, R36 P4 | 14.05.2026 |
SB2026051401 SB2026051497 SB2026051498 and 12 more |
||
| #VU124482 - Improper Neutralization of CRLF Sequences ('CRLF Injection') CVE-2026-28753 |
CWE-93 | Medium | R32 P5, R35 P2, R36 P3 | 25.03.2026 |
SB2026032585 SB20260325200 SB2026041117 and 4 more |
||
| #VU124478 - Heap-based Buffer Overflow CVE-2026-27654 |
CWE-122 | Medium | R32 P5, R35 P2, R36 P3 | 25.03.2026 |
SB2026032585 SB20260325200 SB2026033174 and 17 more |
||
| #VU124475 - Out-of-bounds write CVE-2026-32647 |
CWE-787 | High | R32 P5, R35 P2, R36 P3 | 25.03.2026 |
SB2026032585 SB20260325200 SB2026040801 and 17 more |
||
| #VU124473 - NULL Pointer Dereference CVE-2026-27651 |
CWE-476 | Medium | R32 P5, R35 P2, R36 P3 | 25.03.2026 |
SB2026032585 SB20260325200 SB2026040801 and 17 more |
||
| #VU124470 - Incorrect Authorization CVE-2026-28755 |
CWE-863 | Medium | R32 P5, R35 P2, R36 P3 | 25.03.2026 |
SB2026032585 SB20260325200 SB2026081734 |
||
| #VU114082 - Out-of-bounds read CVE-2025-53859 |
CWE-125 | Low | R32 P3, R33 P3, R34 P2, R35 | 14.08.2025 |
SB2025081427 SB2025082564 SB2025082961 and 12 more |
||
| #VU103686 - Improper Authentication CVE-2025-23419 |
CWE-287 | Low | R32 P2, R33 P2 | 06.02.2025 |
SB2025020653 SB2025020670 SB2025020671 and 17 more |
||
| #VU96037 - Expired pointer dereference CVE-2024-39792 |
CWE-825 | Medium | R31 P3, R32 P1 | 15.08.2024 |
SB2024081520 SB20241230139 SB2025032042 |
||
| #VU96020 - Out-of-bounds read CVE-2024-7347 |
CWE-125 | Medium | R31 P3, R32 P1 | 14.08.2024 |
SB2024081481 SB2024081706 SB2024081707 and 25 more |
||
| #VU90995 - NULL Pointer Dereference CVE-2024-35200 |
CWE-476 | Medium | R31 P2, R32 | 04.06.2024 |
SB2024060431 SB2024083007 SB2026052221 |
||
| #VU90994 - Use After Free CVE-2024-34161 |
CWE-416 | Medium | R31 P2, R32 | 04.06.2024 |
SB2024060431 SB2024083007 SB2026052221 |
||
| #VU90993 - Out-of-bounds write CVE-2024-32760 |
CWE-787 | Medium | R31 P2, R32 | 04.06.2024 |
SB2024060431 SB2024083007 SB20241015123 and 1 more |
||
| #VU90991 - Stack-based buffer overflow CVE-2024-31079 |
CWE-121 | Medium | R31 P2, R32 | 04.06.2024 |
SB2024060431 SB2024083007 SB2026052221 |
||
| #VU86557 - Use After Free CVE-2024-24990 |
CWE-416 | Medium | R30 P2, R31 P1 | 16.02.2024 |
SB2024021636 SB2024022701 SB2024092806 and 1 more |