Login Request a demo
BF
Product
Big-ip Fraud Protection Service
by F5 · last CVE Sep 2, 2026
On CISA KEVExploited in the wildRansomware-linked
404
CVEs
6
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities404In the news1Timeline
Severity mix
Critical 26High 236Medium 139Low 3
Severity
All severities404Critical26High236Medium139Low3
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Big-ip Fraud Protection Service to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-23041
6.1
1%
Sep 14
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS)…
Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.4.1; 14.1.0 before 14.1.4.2; 15.1.0 before 15.1.3; 16.0.0 before 16.0.1.2
CVE-2021-22994
6.1
1%
Mar 31
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed…
Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1
CVE-2021-22979
6.1
1%
Feb 12
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS)…
Affected: 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.2.8; 15.1.0 before 15.1.1; 16.0.0 before 16.0.1
CVE-2020-27719
6.1
1%
Dec 24
On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility
Affected: 14.1.0 before 14.1.3.1; 15.0.0 before 15.1.1; 16.0.0 before 16.0.1
CVE-2020-5915
6.1
1%
Aug 26
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability…
Affected: 11.6.1 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.5; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5
CVE-2020-5903
6.1
2%
Jul 1
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP…
Affected: 12.1.0 through 12.1.5; 13.1.0 through 13.1.3; 14.1.0 through 14.1.2; 15.0.0 through 15.1.0
CVE-2019-6657
6.1
1%
Nov 1
On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management…
Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 through 13.1.3
CVE-2019-6600
6.1
1%
Mar 13
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external…
Affected: 11.5.1 through 11.5.8; 11.6.1 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2
CVE-2019-8331
6.1
16%
Feb 20
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute
Affected: 12.1.0 before 12.1.5.1; 13.0.0 before 13.1.3.4; 14.0.0 before 14.1.2.5; 15.0.0 before 15.1.0
CVE-2019-6589
6.1
1%
Feb 14
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the…
Affected: 11.6.0 through 11.6.3.2; 12.1.0 through 12.1.3.7; 13.0.0 through 13.1.1.3; 14.0.0 through 14.0.0.2
CVE-2018-15312
6.1
1%
Oct 19
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that…
Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1
CVE-2018-15315
6.1
1%
Oct 19
On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page
Affected: 12.1.0 through 12.1.3.6; 13.0.0 through 13.1.1.1
CVE-2024-23976
6.0
0%
Feb 14
BIG-IP Appliance mode iAppsLX vulnerability
Affected: 15.1.0 before 15.1.9; 16.1.0 before 16.1.4; 17.1.0
CVE-2025-58153
5.9
0%
Oct 15
BIG-IP HSB vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.5.0
CVE-2024-28889
5.9
0%
May 8
BIG-IP SSL vulnerability
Affected: 15.1.0 before 15.1.10.4; 16.1.0 before 16.1.4.3; 17.1.0 before 17.1.1.3
CVE-2023-22302
5.9
1%
Feb 1
BIG-IP HTTP profile vulnerability
Affected: 16.1.2.2 before 16.1.3.3; 17.0.0 before 17.0.0.2
CVE-2022-28708
5.9
1%
May 5
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is configured on a virtual…
Affected: 15.1.0; 15.1.1; 15.1.2; 15.1.3; 15.1.4; 15.1.5; +3 more
CVE-2020-5935
5.9
1%
Oct 29
On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic…
Affected: 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.4; 15.0.0 before 15.1.1
CVE-2020-5929
5.9
1%
Sep 25
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client…
Affected: 11.6.1 before 11.6.2; 12.1.0 before 12.1.2; 11.6.2; 12.1.2; 12.1.2; 13.0.0; +2 more
CVE-2020-5917
5.9
1%
Aug 26
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH…
Affected: 11.6.1 through 11.6.5; 12.1.0 before 12.1.5.2; 13.1.0 through 13.1.3; 14.1.0 before 14.1.2.4; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.5
CVE-2020-5854
5.9
1%
Feb 6
On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the…
Affected: 11.5.2 through 11.6.5; 12.1.0 before 12.1.5.1; 13.1.0 before 13.1.3.2; 14.0.0 before 14.0.1.1; 14.1.0 before 14.1.2.1; 15.0.0 before 15.1.0
CVE-2019-6471
5.9
3%
Oct 9
A race condition when discarding malformed packets can cause BIND to exit with an assertion failure
Affected: 11.5.2 through 11.5.9; 11.6.1 through 11.6.4; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0; 14.1.0; +1 more
CVE-2019-6608
5.9
1%
Mar 28
On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when…
Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.3; 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2
CVE-2019-1559
5.9
17%
Feb 27
0-byte record padding oracle
Affected: 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0
CVE-2019-6594
5.9
1%
Feb 26
On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the…
Affected: 11.5.1 through 11.6.3.2; 12.1.3.4 through 12.1.3.7; 13.0.1 through 13.1.1.1; 14.0.0 through 14.0.0.2; 13.0.0; 13.0.0; +1 more
CVE-2019-6593
5.9
1%
Feb 26
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers
Affected: 11.5.1 through 11.5.4; 11.6.1; 12.1.0
CVE-2018-15323
5.9
1%
Oct 31
On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may…
Affected: 13.0.0 through 13.1.1.1; 14.0.0 through 14.0.0.2
CVE-2018-15311
5.9
1%
Oct 10
When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature…
Affected: 11.5.1 through 11.5.6; 11.6.0.0 through 11.6.3.2; 12.1.0.0 through 12.1.3.5; 13.0.0.0 through 13.1.0.5
CVE-2023-43485
5.5
0%
Oct 10
BIGIP and BIG-IQ TACACS+ audit log Vulnerability
Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 before 15.1.9; 16.1.0 before 16.1.4
CVE-2022-35272
5.5
0%
Aug 4
BIG-IP HTTP MRF vulnerability CVE-2022-35272
Affected: 16.1.0 before 16.1.3.1; 17.0.0
CVE-2020-5890
5.5
0%
Apr 30
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for…
Affected: 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.0.0 before 14.1.2.4; 15.0.0 before 15.1.0.2
CVE-2019-19151
5.5
0%
Dec 23
On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version…
Affected: 11.5.1 through 11.6.5; 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.1.0
CVE-2019-6663
5.5
1%
Nov 15
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager…
Affected: 11.5.2 through 11.6.5; 12.1.0 through 12.1.5; 13.0.0 through 13.1.3; 14.0.0 through 14.1.2; 15.0.0 through 15.0.1
CVE-2019-6632
5.5
0%
Jul 3
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because…
Affected: 12.1.0 before 12.1.4.1; 13.0.0 before 13.1.1.5; 14.0.0 before 14.0.0.5; 14.1.0 before 14.1.0.6
CVE-2018-15333
5.5
0%
Dec 28
On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously…
Affected: 11.2.1 through 11.6.3; 12.1.0 through 12.1.4; 13.0.0 through 13.1.1; 14.0.0 through 14.1.0
CVE-2026-40703
5.4
0%
May 13
BIG-IP Configuration utility CSRF vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2023-38423
5.4
0%
Aug 2
BIG-IP Configuration utility vulnerability
Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.5; 15.1.0 before 15.1.9.1; 16.1.0 before 16.1.3.5; 17.0.0 before 17.1.0.2
CVE-2022-28707
5.4
1%
May 5
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists…
Affected: 14.1.0; 14.1.2; 14.1.3; 14.1.4; 15.1.0; 15.1.1; +8 more
CVE-2020-5940
5.4
1%
Nov 5
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management…
Affected: 14.1.0 before 14.1.2.4; 15.1.0 before 15.1.1; 16.0.0 before 16.0.1
CVE-2020-5923
5.4
0%
Aug 26
In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6…
Affected: 11.6.1 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.7; 15.0.0 before 15.1.0.5
CVE-2026-34019
5.3
0%
May 13
BIG-IP BFD vulnerability
Affected: 17.1.0 through 17.1.2; 17.5.0; 16.1.0 through 16.1.6
CVE-2026-40435
5.3
0%
May 13
BIG-IP httpd access control vulnerability
Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6
CVE-2025-58424
5.3
0%
Oct 15
BIG-IP TMM vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6; 17.1.0 through 17.1.2
CVE-2025-59268
5.3
0%
Oct 15
BIG-IP Configuration utility vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 through 17.5.1
CVE-2025-54500
5.3
0%
Aug 13
HTTP/2 Vulnerability
Affected: 15.1.0 before 15.1.10.8; 16.1.0 before 16.1.6.1; 17.1.0 before 17.1.3; 17.5.0 before 17.5.1.2
CVE-2023-24594
5.3
1%
May 3
BIG-IP TMM SSL vulnerability
Affected: 14.1.5; 15.1.4.1; 16.1.2
CVE-2022-29480
5.3
1%
May 5
On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d can cause an…
Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more
CVE-2022-29479
5.3
1%
May 5
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ…
Affected: 11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more
CVE-2022-26130
5.3
1%
May 5
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active…
Affected: 13.1.0; 13.1.1; 13.1.3; 13.1.4; 13.1.5; 14.1.0; +12 more
CVE-2022-27182
5.3
1%
May 5
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual…
Affected: 14.1.0; 14.1.2; 14.1.3; 14.1.4; 15.1.0; 15.1.1; +7 more
Page 7 of 9 · 404 total
1…6789