Known vulnerabilities in NGINX Plus R31

Vendor: F5 Networks
Software: NGINX Plus
Version: R31
Software CPE: cpe:2.3:a:f5_networks:nginx_plus:*:*:*:*:*:*:*:*
Website: https://f5.com/
Total vulnerabilities: 21
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting NGINX Plus version R31 NGINX Plus R31 is affected by 21 vulnerabilities: 2 critical, 1 high, 16 medium, 2 low Critical High Medium Low

Vulnerabilities (21)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134864 - Out-of-bounds read
CVE-2026-48142		 CWE-125 Medium
No
No
 R36 P6, 37.0.2.1 18.06.2026 SB2026061844
SB2026061845
SB2026061846
and 10 more
#VU132220 - Heap-based Buffer Overflow
CVE-2026-9256		 CWE-122 Critical
Public exploit available
No
 R32 P7, R36 P5, 37.0.1.1 25.05.2026 SB2026052502
SB2026052504
SB2026052505
and 12 more
#VU131379 - Use After Free
CVE-2026-40701		 CWE-416 Medium
No
No
 R32 P6, R36 P4 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 12 more
#VU131377 - Heap-based Buffer Overflow
CVE-2026-42945		 CWE-122 Critical
Public exploit available
Exploited
 R32 P6, R36 P4 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 27 more
#VU131375 - Uncontrolled Memory Allocation
CVE-2026-42946		 CWE-789 Medium
No
No
 R32 P6, R36 P4 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 14 more
#VU131374 - Out-of-bounds read
CVE-2026-42934		 CWE-125 Medium
No
No
 R32 P6, R36 P4 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 12 more
#VU124482 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-28753		 CWE-93 Medium
No
No
 R32 P5, R35 P2, R36 P3 25.03.2026 SB2026032585
SB20260325200
SB2026041117
and 4 more
#VU124478 - Heap-based Buffer Overflow
CVE-2026-27654		 CWE-122 Medium
Public exploit available
No
 R32 P5, R35 P2, R36 P3 25.03.2026 SB2026032585
SB20260325200
SB2026033174
and 17 more
#VU124475 - Out-of-bounds write
CVE-2026-32647		 CWE-787 High
No
No
 R32 P5, R35 P2, R36 P3 25.03.2026 SB2026032585
SB20260325200
SB2026040801
and 17 more
#VU124473 - NULL Pointer Dereference
CVE-2026-27651		 CWE-476 Medium
No
No
 R32 P5, R35 P2, R36 P3 25.03.2026 SB2026032585
SB20260325200
SB2026040801
and 17 more
#VU124470 - Incorrect Authorization
CVE-2026-28755		 CWE-863 Medium
No
No
 R32 P5, R35 P2, R36 P3 25.03.2026 SB2026032585
SB20260325200
SB2026081734
#VU114082 - Out-of-bounds read
CVE-2025-53859		 CWE-125 Low
No
No
 R32 P3, R33 P3, R34 P2, R35 14.08.2025 SB2025081427
SB2025082564
SB2025082961
and 12 more
#VU103686 - Improper Authentication
CVE-2025-23419		 CWE-287 Low
No
No
 R32 P2, R33 P2 06.02.2025 SB2025020653
SB2025020670
SB2025020671
and 17 more
#VU96037 - Expired pointer dereference
CVE-2024-39792		 CWE-825 Medium
No
No
 R31 P3, R32 P1 15.08.2024 SB2024081520
SB20241230139
SB2025032042
#VU96020 - Out-of-bounds read
CVE-2024-7347		 CWE-125 Medium
No
No
 R31 P3, R32 P1 14.08.2024 SB2024081481
SB2024081706
SB2024081707
and 25 more
#VU90995 - NULL Pointer Dereference
CVE-2024-35200		 CWE-476 Medium
No
No
 R31 P2, R32 04.06.2024 SB2024060431
SB2024083007
SB2026052221
#VU90994 - Use After Free
CVE-2024-34161		 CWE-416 Medium
No
No
 R31 P2, R32 04.06.2024 SB2024060431
SB2024083007
SB2026052221
#VU90993 - Out-of-bounds write
CVE-2024-32760		 CWE-787 Medium
No
No
 R31 P2, R32 04.06.2024 SB2024060431
SB2024083007
SB20241015123
and 1 more
#VU90991 - Stack-based buffer overflow
CVE-2024-31079		 CWE-121 Medium
No
No
 R31 P2, R32 04.06.2024 SB2024060431
SB2024083007
SB2026052221
#VU86558 - NULL Pointer Dereference
CVE-2024-24989		 CWE-476 Medium
No
No
 R31 P1 16.02.2024 SB2024021636
SB2024022701
SB2024092806
and 1 more


Showing elements 1 - 20 out of 21