CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:00 UTC)

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,470; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product f5:waf. Show all products

12 CVEs, showing 1 to 12

CVE	Severity	Title	Published
CVE-2026-40460	Medium 6.5	When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limi…	May 13, 2026
CVE-2026-40701	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or…	May 13, 2026
CVE-2026-42934	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.	May 13, 2026
CVE-2026-42945	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.	May 13, 2026
CVE-2026-42946	High 7.4	A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.	May 13, 2026
CVE-2026-9256	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.	May 22, 2026
CVE-2026-42055	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.	Jun 17, 2026
CVE-2026-48142	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.	Jun 17, 2026
CVE-2026-42533	High 8.1	A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map out…	Jul 15, 2026
CVE-2026-56434	Medium 6.5	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.	Jul 15, 2026
CVE-2026-60065	Medium 5.3	When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond t…	Jul 15, 2026
CVE-2026-60005	High 8.2	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.	Jul 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.