How many CVEs does F5 have?

F5 has 1,039 published CVE records since 2002, including 160 in the last two years.

How many F5 CVEs are in CISA KEV?

Yes — 13 of F5's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which F5 products have the most CVEs?

The F5 products with the most published CVEs are big-ip_access_policy_manager, big-ip application security manager, big-ip advanced firewall manager, big-ip local traffic manager, big-ip policy enforcement manager.

What are the most common weakness types in F5 CVEs?

F5's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-476 (NULL Pointer Dereference), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

Are there public exploits for F5 vulnerabilities?

Yes — 69 of F5's CVEs have a known public exploit.

How many critical F5 vulnerabilities are there?

F5 has 84 critical and 575 high-severity CVEs.

What is the average severity of F5 CVEs?

The average CVSS base score across F5's scored CVEs is 7.1.

F5 Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: F5 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

F5 has 1,039 published CVE records since 2002, of which 13 are in CISA's Known Exploited Vulnerabilities catalog and 69 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting F5 products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on F5's vulnerability posture, as a share of its 1,039 published CVEs.

Average CVSS: 7.1
Critical / high: 63%
Actively exploited (KEV): 1%
Public exploit available: 7%
Patch available: 64%

Severity and exploitation

How the CVSS severity of F5's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical84

High575

Medium367

Low13

In CISA’s Known Exploited Vulnerabilities catalog

13 of F5's CVEs are confirmed exploited in the wild.

Public exploits

69 of F5's CVEs have a known public exploit available.

Most affected products

The F5 products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in F5 CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish F5 CVE records.

Disclosure activity by year

How many F5 CVEs were published each year.

2019

154

2020

125

2021

2022

132

2023

2024

2025

Latest F5 CVEs

The most recently disclosed vulnerabilities affecting F5.

NGINX ngx_http_slice_module vulnerability
CWE-908
High · CVSS 8.8
EPSS 0.7%2026-07-15
NGINX Plus ngx_stream_mqtt_filter_module vulnerability
CWE-125
Medium · CVSS 6.3
EPSS 0.3%2026-07-15
NGINX ngx_http_ssi_module vulnerability
CWE-416
High · CVSS 8.3
EPSS 0.4%2026-07-15
NGINX Map directive and Regex matching vulnerability

Other vendors

Browse vulnerabilities for other tracked vendors.

Foxit1,137 CVEs vmware1,116 CVEs Juniper1,114 CVEs PHPGurukul1,114 CVEs MediaTek, Inc.1,087 CVEs nvidia1,048 CVEs Joomla992 CVEs pypi962 CVEs

Browse all vendors

Frequently asked questions

Common questions about F5 vulnerabilities.

How many CVEs does F5 have?: F5 has 1,039 published CVE records since 2002, including 160 in the last two years.
How many F5 CVEs are in CISA KEV?: Yes — 13 of F5's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which F5 products have the most CVEs?: The F5 products with the most published CVEs are big-ip_access_policy_manager, big-ip application security manager, big-ip advanced firewall manager, big-ip local traffic manager, big-ip policy enforcement manager.
What are the most common weakness types in F5 CVEs?: F5's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-476 (NULL Pointer Dereference), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).
Are there public exploits for F5 vulnerabilities?: Yes — 69 of F5's CVEs have a known public exploit.
How many critical F5 vulnerabilities are there?: F5 has 84 critical and 575 high-severity CVEs.
What is the average severity of F5 CVEs?: The average CVSS base score across F5's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track F5 vulnerabilities

Monitor new F5 vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing