CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.10)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
A vulnerability exists in BIG-IP and BIG-IQ systems that allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects, enabling the execution of arbitrary commands.
In versions prior to 1.2.1 and 2.0.2, the protobufjs-cli invoked JSDoc by building a shell command string from input file paths. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments.
JupyterLab versions 4.0.0 through 4.5.6 do not correctly enforce the allowed extensions list (allowed_extensions_uris) in the PyPI Extension Manager. This allows installation of extensions from outside the default PyPI index, potentially leading to malicious code execution.
An authenticated remote code execution vulnerability exists in the BIG-IP and BIG-IQ Configuration utility through undisclosed vectors.
When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.
A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.
A vulnerability in BIG-IP PEM iRules may cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic. This affects iRules using specific commands.
A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.
A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).
An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP, leading to privilege escalation.
A vulnerability in SSL profiles on a virtual server can cause it to stop processing new client connections due to undisclosed traffic. The issue affects software versions that have not reached End of Technical Support.
A vulnerability in BIG-IP allows TMM termination by undisclosed traffic when an SSL profile is configured on Virtual Edition without QAT or on hardware with disabled hardware acceleration.
A vulnerability in BIG-IP allows termination of the TMM process via undisclosed traffic when a SIP profile is configured on a virtual server. The issue affects F5 Networks software.
A vulnerability in BIG-IP APM causes undisclosed traffic to terminate the apmd process when an APM access policy is configured on a virtual server.
In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.
A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.
A vulnerability in iControl REST and TMOS Shell (tmsh) allows an authenticated attacker with at least the Manager role to create configuration objects that enable arbitrary command execution.
When a BIG-IP is configured with DNS caching (such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.