2025 CVE Vulnerabilities
45,221 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-61951 | HIGH | 8.7 | 0.2% | Oct 15, 2025 | Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagr... |
| CVE-2025-61938 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for th... |
| CVE-2025-60016 | HIGH | 8.7 | 0.4% | Oct 15, 2025 | When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cip... |
| CVE-2025-60015 | MEDIUM | 6.9 | 0.2% | Oct 15, 2025 | An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Softw... |
| CVE-2025-60013 | MEDIUM | 4.6 | 0.2% | Oct 15, 2025 | When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with sp... |
| CVE-2025-59781 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increas... |
| CVE-2025-59778 | HIGH | 7.7 | 0.3% | Oct 15, 2025 | When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause... |
| CVE-2025-59483 | MEDIUM | 6.5 | 0.3% | Oct 15, 2025 | A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which hav... |
| CVE-2025-59481 | HIGH | 8.7 | 0.4% | Oct 15, 2025 | A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authentica... |
| CVE-2025-59478 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can... |
| CVE-2025-59269 | HIGH | 8.4 | 0.3% | Oct 15, 2025 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that... |
| CVE-2025-59268 | MEDIUM | 6.9 | 0.4% | Oct 15, 2025 | On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthent... |
| CVE-2025-58474 | MEDIUM | 5.3 | 0.4% | Oct 15, 2025 | When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an... |
| CVE-2025-58424 | MEDIUM | 6.3 | 0.2% | Oct 15, 2025 | On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which d... |
| CVE-2025-58153 | MEDIUM | 5.9 | 0.2% | Oct 15, 2025 | Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-S... |
| CVE-2025-58120 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. ... |
| CVE-2025-58096 | HIGH | 8.2 | 0.3% | Oct 15, 2025 | When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undi... |
| CVE-2025-56746 | LOW | 2.2 | 0.2% | Oct 15, 2025 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabli... |
| CVE-2025-55670 | HIGH | 7.1 | 0.3% | Oct 15, 2025 | On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause th... |
| CVE-2025-55669 | HIGH | 8.7 | 0.4% | Oct 15, 2025 | When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server... |
| CVE-2025-55036 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is e... |
| CVE-2025-54858 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed ... |
| CVE-2025-54854 | HIGH | 8.7 | 0.3% | Oct 15, 2025 | When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclos... |
| CVE-2025-54805 | MEDIUM | 6.5 | 0.3% | Oct 15, 2025 | When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can ... |
| CVE-2025-54755 | MEDIUM | 4.9 | 1.1% | Oct 15, 2025 | A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access file... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now