|
751
|
5.3 |
MEDIUM
Network
|
-
|
-
|
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter i…
New
|
CWE-284
CWE-436
Improper Access Control
Interpretation Conflict
|
CVE-2026-42177
|
2026-05-14 01:31 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
752
|
8.1 |
HIGH
Network
|
-
|
-
|
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.
Note: Software versions which have re…
New
|
CWE-22
Path Traversal
|
CVE-2026-20916
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
753
|
6.8 |
MEDIUM
Network
|
-
|
-
|
When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cros…
New
|
CWE-35
Path Traversal: '.../...//'
|
CVE-2026-24464
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
754
|
4.4 |
MEDIUM
Local
|
-
|
-
|
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is als…
New
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2026-28758
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
755
|
8.7 |
HIGH
Network
|
-
|
-
|
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running ar…
New
|
CWE-250
Execution with Unnecessary Privileges
|
CVE-2026-32643
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
756
|
8.7 |
HIGH
Network
|
-
|
-
|
A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher priv…
New
|
CWE-250
Execution with Unnecessary Privileges
|
CVE-2026-32673
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
757
|
5.3 |
MEDIUM
Network
|
-
|
-
|
When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD pack…
New
|
CWE-410
Insufficient Resource Pool
|
CVE-2026-34019
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
758
|
8.7 |
HIGH
Network
|
-
|
-
|
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a securit…
New
|
CWE-78
OS Command
|
CVE-2026-34176
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
759
|
6.5 |
MEDIUM
Network
|
-
|
-
|
An authenticated iControl SOAP user may be able to obtain information of other accounts.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
New
|
CWE-266
Incorrect Privilege Assignment
|
CVE-2026-35062
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
760
|
7.5 |
HIGH
Network
|
-
|
-
|
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file d…
New
|
CWE-772
Missing Release of Resource after Effective Lifetime
|
CVE-2026-39455
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
