Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.5An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.May 13, 2026
- High8.7When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.May 13, 2026
- High8.7When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with th…May 13, 2026
- High7.1Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sens…May 13, 2026
- Medium6.9When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of auth…May 13, 2026
- Medium6.9When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.May 13, 2026
- High8.7When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.May 13, 2026
- High8.7When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.May 13, 2026
- High8.5When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker wi…May 13, 2026
- High8.7When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.May 13, 2026
- High8.6A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configura…May 13, 2026
- High8.7When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause…May 13, 2026
- High8.7When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process…May 13, 2026
- High7.1An authenticated iControl SOAP user may be able to obtain information of other accounts.May 13, 2026
- High8.5When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint.May 13, 2026
- Medium6.3When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (…May 13, 2026
- High8.5A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary…May 13, 2026
- High8.5A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configurati…May 13, 2026
- Medium6.7When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the i…May 13, 2026
- Medium6.9When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with admin…May 13, 2026
- High7.2An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.EPSS 0.4%May 13, 2026
- High8.8The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable…May 12, 2026
- High8.8The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable…May 12, 2026
- Critical9.8The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) allows arbitr…May 12, 2026
- Critical9.8The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deserializatio…May 12, 2026