pfSense CE vulnerabilities | LiveThreat CVE Feed

Product

pfSense CE

by Netgate · last CVE Oct 15, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities29 In the news0 Timeline

Severity mix

Critical 0High 17Medium 12Low 0

Severity

All severities29 Critical0 High17 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add pfSense CE to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-111225	8.8	6%	Oct 15	Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh Affected: 2.5.0 through 2.9.0
CVE-2024-54780	8.8	13%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of… Affected: before 2.8.0
CVE-2026-97730	8.5	1%	Sep 25	In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an… Affected: before 2.9.0
CVE-2026-111224	7.5	5%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh Affected: through 2.9.0
CVE-2026-111231	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() Affected: through 2.9.0
CVE-2026-111229	7.2	6%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync Affected: 2.7.0 through 2.9.0
CVE-2026-111226	7.2	7%	Oct 15	Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php Affected: 2.4.5 through 2.9.0
CVE-2026-111223	7.2	1%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner Affected: 2.7.0 through 2.9.0
CVE-2026-111222	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting Affected: through 2.9.0
CVE-2026-111221	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection Affected: through 2.9.0
CVE-2026-111220	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid Affected: through 2.9.0
CVE-2026-111219	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username Affected: through 2.9.0
CVE-2026-111218	7.2	9%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters Affected: 2.7.0 through 2.9.0
CVE-2026-111217	7.2	7%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID Affected: through 2.9.0
CVE-2026-111216	7.2	5%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP Affected: through 2.9.0
CVE-2026-111215	7.2	6%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface Affected: through 2.9.0
CVE-2026-111214	7.2	11%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php Affected: 2.7.0 through 2.9.0
CVE-2026-111233	6.1	1%	Oct 15	Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php Affected: 2.7.1 through 2.9.0
CVE-2026-67189	6.1	1%	Aug 19	pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record Affected: through 2.8.1
CVE-2023-48795	5.9	94%	Dec 18	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: through 2.7.2
CVE-2026-111228	5.5	2%	Oct 15	Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php Affected: 2.7.1 through 2.9.0
CVE-2026-111227	5.5	2%	Oct 15	Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php Affected: through 2.9.0
CVE-2026-56128	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php Affected: before 2.9.0
CVE-2026-56127	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php Affected: before 2.9.0
CVE-2026-56126	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php Affected: before 2.9.0
CVE-2024-57273	5.4	1%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service,… Affected: before 2.8.0
CVE-2024-54779	5.4	9%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php Affected: before 2.8.0
CVE-2026-111230	4.9	1%	Oct 15	Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL Affected: through 2.9.0
CVE-2026-111232	4.8	1%	Oct 15	Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color Affected: 2.3.0 through 2.9.0