CVE-2022-29263High· 7.8▾ TwilightOn F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versio…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
access_policy_manager_clients = 7.1.8access_policy_manager_clients = 7.1.8.5access_policy_manager_clients = 7.1.9access_policy_manager_clients = 7.1.9.7access_policy_manager_clients = 7.1.9.8access_policy_manager_clients = 7.2.1access_policy_manager_clients = 7.2.1.1big-ip_access_policy_manager = 11.6.1big-ip_access_policy_manager = 11.6.2big-ip_access_policy_manager = 11.6.3big-ip_access_policy_manager = 11.6.4big-ip_access_policy_manager = 11.6.5big-ip_access_policy_manager = 12.1.0big-ip_access_policy_manager = 12.1.1big-ip_access_policy_manager = 12.1.2big-ip_access_policy_manager = 12.1.3big-ip_access_policy_manager = 12.1.4big-ip_access_policy_manager = 12.1.5big-ip_access_policy_manager = 12.1.6big-ip_access_policy_manager = 13.1.0big-ip_access_policy_manager = 13.1.1big-ip_access_policy_manager = 13.1.3big-ip_access_policy_manager = 13.1.4big-ip_access_policy_manager = 13.1.5big-ip_access_policy_manager = 14.1.0big-ip_access_policy_manager = 14.1.2big-ip_access_policy_manager = 14.1.3big-ip_access_policy_manager = 14.1.4big-ip_access_policy_manager = 15.1.0big-ip_access_policy_manager = 15.1.1big-ip_access_policy_manager = 15.1.2big-ip_access_policy_manager = 15.1.3big-ip_access_policy_manager = 15.1.4big-ip_access_policy_manager = 15.1.5big-ip_access_policy_manager = 16.1.0big-ip_access_policy_manager = 16.1.1big-ip_access_policy_manager = 16.1.2big-ip_access_policy_manager = 17.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97629Medium· 6.5Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticate…
CVE-2026-97205High· 8.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module
CVE-2026-96615Medium· 6.5Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent
CVE-2026-95101Medium· 5.3Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module
CVE-2026-94197High· 7.5An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication
CVE-2026-93479High· 8.1A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable