Currently exploited vulnerabilities

CVE ID	CVSS	Exploitable	Vendor	Product	Vulnerability	Date added
CVE-2026-94127	CVSS 4.0 · 9.3	True	F5	BIG-IP APM	F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability	2026-09-22 00:00:00
CVE-2025-53521	CVSS 4.0 · 9.3	True	F5	BIG-IP	F5 BIG-IP Stack-Based Buffer Overflow Vulnerability	2026-03-27 00:00:00
CVE-2023-46747	CVSS 3.1 · 9.8	True	F5	BIG-IP Configuration Utility	F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability	2023-10-31 00:00:00
CVE-2023-46748	CVSS 3.1 · 8.8	True	F5	BIG-IP Configuration Utility	F5 BIG-IP Configuration Utility SQL Injection Vulnerability	2023-10-31 00:00:00
CVE-2022-1388	CVSS 3.1 · 9.8	True	F5	BIG-IP	F5 BIG-IP Missing Authentication Vulnerability	2022-05-10 00:00:00
CVE-2021-22991	CVSS 3.1 · 9.8	True	F5	BIG-IP Traffic Management Microkernel	F5 BIG-IP Traffic Management Microkernel Buffer Overflow	2022-01-18 00:00:00
CVE-2021-22986	CVSS 3.1 · 9.8	True	F5	BIG-IP and BIG-IQ Centralized Management	F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability	2021-11-03 00:00:00
CVE-2020-5902	CVSS 3.1 · 9.8	True	F5	BIG-IP	F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability	2021-11-03 00:00:00

AVET INS is an owner of VULNDBASE brand and website. This product uses data from the NVD API but is not endorsed or certified by the NVD. See NVD page for more information. CVE is a registered trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE site. CWE is a registered trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE page. KEV (Known Exploited Vulnerabilities) is a catalog maintained by CISA. EUVD is the official EU repository for timely, curated cybersecurity vulnerability intelligence and remediation guidance run by ENISA. DORA (Digital Operational Resilience Act) is and EU directive.