F5 Networks

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any F5 Networks product.

RSS Feeds for F5 Networks security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in F5 Networks products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by F5 Networks Sorted by Most Security Vulnerabilities since 2018

F5 Networks Big Ip Access Policy Manager433 vulnerabilities

F5 Networks Big Ip Application Security Manager399 vulnerabilities

F5 Networks Big Ip Advanced Firewall Manager382 vulnerabilities

F5 Networks Big Ip Local Traffic Manager371 vulnerabilities

F5 Networks Big Ip Policy Enforcement Manager365 vulnerabilities

F5 Networks Big Ip Link Controller360 vulnerabilities

F5 Networks Big Ip Application Acceleration Manager359 vulnerabilities

F5 Networks Big Ip Analytics357 vulnerabilities

F5 Networks Big Ip Global Traffic Manager346 vulnerabilities

F5 Networks Big Ip Domain Name System346 vulnerabilities

F5 Networks Big Ip Fraud Protection Service318 vulnerabilities

F5 Networks Big Ip Webaccelerator173 vulnerabilities

F5 Networks Big Ip Edge Gateway166 vulnerabilities

F5 Networks Big Ip Advanced Web Application Firewall105 vulnerabilities

F5 Networks Big Ip103 vulnerabilities

F5 Networks Big Ip Ddos Hybrid Defender81 vulnerabilities

F5 Networks Big Iq Centralized Management68 vulnerabilities

F5 Networks Big Ip Ssl Orchestrator63 vulnerabilities

F5 Networks Big Ip Websafe54 vulnerabilities

F5 Networks Nginx48 vulnerabilities

F5 Networks 39 vulnerabilities

F5 Networks Njs39 vulnerabilities

F5 Networks Traffix Signaling Delivery Controller29 vulnerabilities

F5 Networks Big Ip Carrier Grade Nat28 vulnerabilities

F5 Networks Big Ip Application Visibility Reporting28 vulnerabilities

F5 Networks Enterprise Manager27 vulnerabilities

F5 Networks Ssl Orchestrator26 vulnerabilities

F5 Networks Tomcat23 vulnerabilities

F5 Networks Big Ip Protocol Security Module21 vulnerabilities

F5 Networks Big Ip Access Policy Manager Client15 vulnerabilities

F5 Networks Nginx Plus13 vulnerabilities

F5 Networks Nginx Open Source10 vulnerabilities

F5 Networks Http Server10 vulnerabilities

F5 Networks Big Ip Wan Optimization Manager10 vulnerabilities

F5 Networks F5os A8 vulnerabilities

F5 Networks Nginx Ingress Controller8 vulnerabilities

F5 Networks Big Ip Next Central Manager8 vulnerabilities

F5 Networks Big Ip Next Service Proxy Kubernetes8 vulnerabilities

F5 Networks F5os C7 vulnerabilities

F5 Networks Big Ip Container Ingress Services7 vulnerabilities

F5 Networks Mysql7 vulnerabilities

F5 Networks Big Ip Automation Toolchain6 vulnerabilities

F5 Networks Nginx Instance Manager6 vulnerabilities

F5 Networks Big Ip Next Cloud Native Network Functions5 vulnerabilities

F5 Networks Big Iq Cloud5 vulnerabilities

F5 Networks Big Iq Device5 vulnerabilities

F5 Networks Big Iq Security5 vulnerabilities

F5 Networks Big Ip Apm4 vulnerabilities

F5 Networks Big Ip Dns4 vulnerabilities

F5 Networks Java3 vulnerabilities

F5 Networks Nginx Api Connectivity Manager3 vulnerabilities

F5 Networks Big Ip Next3 vulnerabilities

F5 Networks Nginx Agent2 vulnerabilities

F5 Networks Nginx Unit1 vulnerability

F5 Networks Ofbiz1 vulnerability

F5 Networks Solr1 vulnerability

F5 Networks Nginx Openid Connect1 vulnerability

F5 Networks Graalvm1 vulnerability

Recent F5 Networks Security Advisories

Advisory	Title	Published
K000160295	K000160295: Intel CPU vulnerability CVE-2025-20109	March 11, 2026
K000160292	K000160292: Curl vulnerability CVE-2025-14524	March 10, 2026
K000160291	K000160291: PostgreSQL vulnerability CVE-2025-12818	March 10, 2026
K000160290	K000160290: PostgreSQL vulnerability CVE-2025-12817	March 10, 2026
K000160226	K000160226: Intel 800 Series Ethernet vulnerability CVE-2025-24325	March 10, 2026
K000160272	K000160272: Apache Solr vulnerability CVE-2026-22444	March 9, 2026
K000160227	K000160227: Linux kernel vulnerability CVE-2025-37849	March 4, 2026
K000160225	K000160225: Intel 800 Ethernet vulnerability CVE-2025-23241	March 4, 2026
K000160224	K000160224: Intel 800 Series Ethernet vulnerability CVE-2025-24484	March 4, 2026
K000160223	K000160223: Spring cloud gateway vulnerability CVE-2025-41243	March 4, 2026

Known Exploited F5 Networks Vulnerabilities

The following F5 Networks vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
F5 BIG-IP Configuration Utility SQL Injection Vulnerability	F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. CVE-2023-46748 Exploit Probability: 4.3%	October 31, 2023
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability	F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. CVE-2023-46747 Exploit Probability: 94.4%	October 31, 2023
F5 BIG-IP Missing Authentication Vulnerability	F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. CVE-2022-1388 Exploit Probability: 94.5%	May 10, 2022
F5 BIG-IP Traffic Management Microkernel Buffer Overflow	The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. CVE-2021-22991 Exploit Probability: 73.1%	January 18, 2022
F5 BIG-IP Traffic Management User Interface Remote Code Execution Vulnerability	In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. CVE-2020-5902 Exploit Probability: 94.4%	November 3, 2021
F5 iControl REST unauthenticated Remote Code Execution Vulnerability	The iControl REST interface has an unauthenticated remote command execution vulnerability. CVE-2021-22986 Exploit Probability: 94.5%	November 3, 2021

Of the known exploited vulnerabilities above, 4 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. The vulnerability CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow is in the top 5% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 20 vulnerabilities in F5 Networks with an average score of 6.2 out of ten. Last year, in 2025 F5 Networks had 342 security vulnerabilities published. Right now, F5 Networks is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.65

Year	Vulnerabilities	Average Score
2026	20	6.24
2025	342	6.89
2024	345	6.42
2023	175	6.99
2022	404	7.04
2021	326	7.24
2020	262	6.64
2019	300	6.75
2018	216	7.03

It may take a day or so for new F5 Networks vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent F5 Networks Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-2507	Feb 18, 2026	BIG-IP AFM/DDoS Undisclosed Traffic Causing TMM Crash When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Big Ip
CVE-2025-35998	Feb 10, 2026	Privilege Escalation via Missing Protection in Intel Quick Assist Tech (Ring 0) Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2025-59023	Feb 09, 2026	BIND Recursor Cached Delegation Poisoning via Crafted Delegations/IP Fragments Crafted delegations or IP fragments can poison cached delegations in Recursor.
CVE-2026-22549	Feb 04, 2026	F5 BIG-IP CIS Excessive Perm. for Reading Cluster Secrets A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Big Ip Container Ingress Services
CVE-2026-22548	Feb 04, 2026	BIG-IP Advanced WAF/ASM Crash via Undisclosed Requests (CVE-2026-22548) When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Big Ip
CVE-2026-1642	Feb 04, 2026	NGINX TLS Proxy MITM Plain Text Injection A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server sidealong with conditions beyond the attacker's controlmay be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Nginx Open Source Nginx Plus
CVE-2026-20732	Feb 04, 2026	F5 BIG-IP Config Page Spoof Error Vulnerability A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Big Ip
CVE-2026-20730	Feb 04, 2026	BIG-IP Edge Client Info Disclosure via Windows VPN Client A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated	Big Ip
CVE-2025-15469	Jan 27, 2026	OpenSSL 3.5+ Dgst Cmd Truncates >16MB Input for OneShot Signatures Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. When the 'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input is buffered with a 16MB limit. If the input exceeds this limit, the tool silently truncates to the first 16MB and continues without signaling an error, contrary to what the documentation states. This creates an integrity gap where trailing bytes can be modified without detection if both signing and verification are performed using the same affected codepath. The issue affects only the command-line tool behavior. Verifiers that process the full message using library APIs will reject the signature, so the risk primarily affects workflows that both sign and verify with the affected 'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and library users are unaffected. The FIPS modules in 3.5 and 3.6 are not affected by this issue, as the command-line tools are outside the OpenSSL FIPS module boundary. OpenSSL 3.5 and 3.6 are vulnerable to this issue. OpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.
CVE-2025-15468	Jan 27, 2026	OpenSSL 3.2+ NULL Deref in SSL_CIPHER_find() for QUIC Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported. As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity. The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support. The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.
CVE-2025-15467	Jan 27, 2026	OpenSSL 3.x CMS AuthEnvelopedData AEAD IV stack overflow (v3.6+) Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
CVE-2026-23864	Jan 26, 2026	DoS via crafted HTTP in React Server Components (react-server-dom-*) Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
CVE-2026-22444	Jan 21, 2026	Apache Solr 8.6-9.10.0 Core-Create API Path Validation Bypass The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element . These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem. On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes. Solr deployments are subject to this vulnerability if they meet the following criteria: * Solr is running in its "standalone" mode. * Solr's "allowPath" setting is being used to restrict file access to certain directories. * Solr's "create core" API is exposed and accessible to untrusted users. This can happen if Solr's RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles. Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores. Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.	Solr
CVE-2026-24061	Jan 21, 2026	Authentication Bypass in GNU Inetutils telnetd <=2.7 via USER var telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2026-21947	Jan 20, 2026	Oracle Java SE 8u471-b50 JavaFX Unauth Update Manipulation Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).	Java
CVE-2026-21941	Jan 20, 2026	MySQL Server 8.0-8.44/8.4-8.4.7/9.0-9.5 DOS via Optimizer Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-21937	Jan 20, 2026	Oracle MySQL Server DDL DOS via Protocol Exploit (8.0-9.5) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2025-68493	Jan 11, 2026	Apache Struts XML Validation Flaw (2.0.06.1.0) Fixed in 6.1.1 Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
CVE-2025-14524	Jan 08, 2026	curl: OAuth2 Bearer Token Leak via Cross-Protocol Redirect When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.
CVE-2026-22184	Jan 07, 2026	zlib untgz Global Buffer Overflow pre1.3.1.2 zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
CVE-2025-69204	Dec 30, 2025	ImageMagick is free and open-source software used for editing and manipulating digital images ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
CVE-2025-68618	Dec 30, 2025	ImageMagick is free and open-source software used for editing and manipulating digital images ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
CVE-2025-66863	Dec 29, 2025	An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVE-2025-66862	Dec 29, 2025	A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVE-2025-66865	Dec 29, 2025	An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVE-2025-68615	Dec 22, 2025	Net-SNMP snmptrapd Buffer Overflow Vulnerability Prior to 5.9.5 and 5.10.pre2 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.
CVE-2025-68161	Dec 18, 2025	Log4j Core 2.0-2.25.2 Socket Appender TLS Hostname Verification Bypass The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appenders configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
CVE-2025-14727	Dec 17, 2025	NGINX Ingress Controller Annotation Validation Flaw in rewrite-target Annotation A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	Nginx Ingress Controller
CVE-2025-55184	Dec 11, 2025	React Server Components pre-auth DoS <19.3 via insecure payload deserialization A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVE-2025-55183	Dec 11, 2025	Inform. Leak in React Server Components 19.0.019.2.1 via Server Function An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
CVE-2025-9613	Dec 09, 2025	PCIe IDE Tag Aliasing Enables Cross-Context Completion Leak A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing condition can result in completions being delivered to the wrong security context, potentially compromising data integrity and confidentiality.
CVE-2025-9614	Dec 09, 2025	PCIe IDE Spec: Stale Write Leakage via Re-binding An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushing during device rebinding may allow stale write transactions from a previous security context to be processed in a new one. This can lead to unintended data access across trusted domains, compromising confidentiality and integrity.
CVE-2025-9612	Dec 09, 2025	PCIe IDE Spec Vulnerable to TLP Replay/Reorder An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections.
CVE-2025-59029	Dec 09, 2025	DNS ANY Query Assertion Failure in Caching DNS Server An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
CVE-2025-66200	Dec 05, 2025	Apache HTTP Server 2.4.765 AllowOverride FileInfo Bypass mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.	Http Server
CVE-2025-66516	Dec 04, 2025	Apache Tika XXE prior 3.2.2 & 1.28.5 (tika-core, pdf-module, parsers) Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
CVE-2025-66293	Dec 03, 2025	libpng OOB Read in simplified API before 1.6.52 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
CVE-2025-55182	Dec 03, 2025	RCFC 19.019.2 Remote Code Exec via Unsafe Deserialization A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVE-2025-64775	Dec 01, 2025	Apache Struts DOS via multipart request file leak (6.7.0/7.0.3) Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
CVE-2025-12183	Nov 28, 2025	Out-of-bounds memory ops in lz4-java 1.8.0 and earlier Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
CVE-2025-12816	Nov 25, 2025	node-forge <1.3.1 ASN.1 Conflict (CWE-436) Allows Auth Bypass An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
CVE-2025-64720	Nov 24, 2025	libpng 1.6.0-1.6.51 OOB Read in png_image_read_composite LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.
CVE-2025-12818	Nov 13, 2025	PostgreSQL libpq Int Wraparound OOB Allocation 13-17 Pre-18.1 Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
CVE-2025-12817	Nov 13, 2025	PostgreSQL CREATE STATISTICS Auth Bypass Causing DoS 18.1 Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
CVE-2025-35968	Nov 11, 2025	Privilege Escalation via UEFI Slim Bootloader Protection Failure Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2025-33000	Nov 11, 2025	Intel QAT Privilege Escalation (Vulnerable <2.6.0) Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2025-30185	Nov 11, 2025	Intel UEFI Ring 0 Escalation via Active Debug Code Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.
CVE-2025-10230	Nov 07, 2025	Samba WINS Hook RCE via Unvalidated NetBIOS Names A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controllers wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
CVE-2025-58187	Oct 29, 2025	OpenSSL Certificate Chain Timing Attack via Name Constraints Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
CVE-2025-40047	Oct 28, 2025	Linux Kernel io_uring Wait Queue Race (CVE-2025-40047) In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback.