f5sirt@f5.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS f5sirt@f5.com
03
assessed vulnerabilities (368)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-97629US | medium6.5 | Exploit | ||
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file directives to automaticall… | ||||
| CVE-2026-97205US | high8.1 | Exploit | ||
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server… | ||||
| CVE-2026-96615US | medium6.5 | — | ||
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agen… | ||||
| CVE-2026-95101US | medium5.3 | — | ||
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticate… | ||||
| CVE-2026-94197US | high7.5 | — | ||
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external a… | ||||
| CVE-2026-93479US | high8.1 | — | ||
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture v… | ||||
| CVE-2026-91184US | high8.8 | — | ||
Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and u… | ||||
| CVE-2026-15176US | high8.1 | — | ||
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referenci… | ||||
| CVE-2026-104939US | high7.5 | — | ||
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAut… | ||||
| CVE-2026-101025US | medium5.3 | — | ||
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register clea… | ||||
| CVE-2026-101019US | medium6.5 | — | ||
Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built… | ||||
| CVE-2026-94127US | critical9.8OT critical | KEV | ||
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is o… | ||||
| CVE-2026-90439US | medium6.5 | — | ||
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a lim… | ||||
| CVE-2026-78689US | high8.1 | — | ||
Description
NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remo… | ||||
| CVE-2026-78222US | high7.5 | — | ||
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Expl… | ||||
| CVE-2026-77180US | high8.3 | — | ||
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-co… | ||||
| CVE-2026-66842US | high8.8 | — | ||
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Inte… | ||||
| CVE-2026-66362US | high8.1 | — | ||
Description:
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gat… | ||||
| CVE-2026-63020US | low3.1 | — | ||
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BI… | ||||
| CVE-2026-18329US | high8.2 | — | ||
Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown… | ||||