Skip to content

Pfsense vulnerabilities

Products

Newest

netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php CVE-2026-111233 2.3 LowOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color CVE-2026-111232 4.8 MediumOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL CVE-2026-111230 6.9 MediumOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php CVE-2026-111228 5.1 MediumOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php CVE-2026-111227 5.1 MediumOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh CVE-2026-111225 2.3 LowOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner CVE-2026-111223 8.6 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting CVE-2026-111222 7.5 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username CVE-2026-111219 7.5 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters CVE-2026-111218 8.6 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID CVE-2026-111217 8.6 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP CVE-2026-111216 8.6 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface CVE-2026-111215 8.6 HighOctober 15, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php CVE-2026-111214 EPSS 10.8% 8.6 HighOctober 15, 2026
pfsense Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the... CVE-2025-69691 Disputed 9.9 CriticalMay 8, 2026
pfsense Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file... CVE-2025-69690 Public exploitDisputed 9.1 CriticalMay 8, 2026
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CVE-2025-34178 5.1 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CVE-2025-34177 5.1 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure CVE-2025-34176 EPSS 17.3% 5.3 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting CVE-2025-34175 EPSS 21.3% 5.1 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting CVE-2025-34174 EPSS 14.5% 5.1 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure CVE-2025-34173 5.3 MediumSeptember 9, 2025
netgate pfsense ce, pfsense +1 more Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting CVE-2025-34172 4.8 MediumSeptember 9, 2025
netgate pfsense In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading... CVE-2025-53392 Public exploitDisputed 5.0 MediumJune 28, 2025
netgate pfsense A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute... CVE-2024-46538 Public exploit EPSS 80.3% 4.8 MediumOctober 22, 2024
pfsense An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any... CVE-2023-29975 7.2 HighNovember 9, 2023
pfsense An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via... CVE-2023-29974 9.8 CriticalNovember 8, 2023
pfsense Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating... CVE-2023-29973 4.9 MediumOctober 24, 2023
oisf suricata, pfsense, pfsense suricata package +2 more Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0... CVE-2020-19678 7.5 HighApril 6, 2023
netgate pfsense plus, pfsense +1 more Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate... CVE-2023-27100 Public exploit 9.8 CriticalMarch 22, 2023
pfsense pfblockerng pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as... CVE-2022-40624 Public exploit EPSS 18.2% 9.8 CriticalDecember 20, 2022
pfsense pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the... CVE-2022-42247 6.1 MediumOctober 3, 2022
netgate pfsense, pfsense plus, pfsense ce and pfsense plus +2 more Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software... CVE-2022-26019 8.8 HighMarch 31, 2022
netgate pfsense, pfsense plus, pfsense ce and pfsense plus +2 more Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software... CVE-2022-24299 8.8 HighMarch 31, 2022
netgate pfsense plus, pfsense, pfsense ce and pfsense plus +2 more Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2... CVE-2021-20729 6.1 MediumMarch 31, 2022
pfsense pfsense-pkg-wireguard Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions... CVE-2022-21132 6.5 MediumMarch 7, 2022
pfsense diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to... CVE-2021-41282 Public exploit EPSS 87.1% 8.8 HighMarch 1, 2022
pfsense, pfsense plus +1 more /usr/local/www/pkg.php in pfSense through 2.5.2 uses $_REQUEST['pkg_filter'] in a PHP echo call. CVE-2022-23993 6.1 MediumJanuary 26, 2022
pfsense A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows... CVE-2020-26693 5.4 MediumJune 1, 2021
pfsense pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field. CVE-2021-27933 EPSS 26.6% 6.1 MediumApril 28, 2021
pfsense pfsense-pkg-freeradius3 /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense... CVE-2019-18667 6.1 MediumNovember 2, 2019
pfsense pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|'... CVE-2016-10709 Public exploit EPSS 33.7% 8.8 HighJanuary 22, 2018
netgate pfsense, pfsense suricata package +1 more Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2... CVE-2014-4696 5.8 MediumJuly 2, 2014
netgate pfsense, pfsense snort package +1 more Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1... CVE-2014-4695 5.8 MediumJuly 2, 2014
netgate pfsense, pfsense suricata package +1 more Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata... CVE-2014-4694 4.3 MediumJuly 2, 2014
netgate pfsense, pfsense snort package +1 more Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for... CVE-2014-4693 4.3 MediumJuly 2, 2014
pfsense Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows... CVE-2011-5047 4.3 MediumJanuary 3, 2012
pfsense etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509... CVE-2011-4197 7.5 HighJanuary 3, 2012