Vulnerabilities in F5

421 results
Vexday analysis

Com 404 CVEs catalogadas e taxa de exploração ativa 2,2 vezes acima da média geral do catálogo CISA KEV, os produtos F5 exigem atenção redobrada na priorização de correções. O destaque mais crítico é CVE-2022-1388, com escore EPSS de 0,9996 — indicando probabilidade extremamente alta de exploração ativa —, o que a posiciona como prioridade imediata de remediação. A presença de 8 CVEs com PoC pública e 9 de severidade crítica amplia a superfície de risco explorável, especialmente considerando que 59 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo relevante de descobertas recentes. O tipo de falha mais comum, CWE-476 (null pointer dereference), sugere oportunidades de melhoria estrutural no ciclo de desenvolvimento seguro, embora as explorações confirmadas tendam a concentrar-se nas falhas de controle de acesso e execução remota.

CVE-2026-48142MEDIUMNGINX ngx_http_charset_module vulnerabilityEPSS 0.7%CVE-2022-30535MEDIUMNGINX Ingress Controller vulnerability CVE-2022-30535EPSS 0.7%CVE-2019-6639—On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMEPSS 0.7%CVE-2023-22323HIGHBIG-IP SSL OCSP Authentication profile vulnerabilityEPSS 0.7%CVE-2022-41833HIGHBIG-IP iRule vulnerability CVE-2022-41833EPSS 0.7%CVE-2022-41832HIGHBIG-IP SIP vulnerability CVE-2022-41832EPSS 0.7%CVE-2022-41836HIGHBIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836EPSS 0.7%CVE-2022-41691HIGHBIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691EPSS 0.7%CVE-2022-41787HIGHBIG-IP DNS Express vulnerability CVE-2022-41787EPSS 0.7%CVE-2022-41624HIGHBIG-IP iRules vulnerability CVE-2022-41624EPSS 0.7%CVE-2022-41806HIGHBIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806EPSS 0.7%CVE-2022-36795MEDIUMBIG-IP software SYN cookies vulnerability CVE-2022-36795EPSS 0.7%CVE-2022-35728HIGHiControl REST vulnerability CVE-2022-35728EPSS 0.7%CVE-2019-6657—On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosedEPSS 0.6%CVE-2022-41813MEDIUMBIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813EPSS 0.6%CVE-2022-41770MEDIUMBIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770EPSS 0.6%CVE-2022-41694MEDIUMBIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694EPSS 0.6%CVE-2024-39792HIGHNGINX Plus MQTT vulnerabilityEPSS 0.6%CVE-2022-28707HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-sitEPSS 0.6%CVE-2023-22839HIGHBIG-IP DNS profile vulnerabilityEPSS 0.6%