pfSense CE vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

PC

Product

pfSense CE

by Netgate · last CVE Oct 15, 2026

29

CVEs

0

On KEV

8.8

Max CVSS

20

New 30D

Vulnerabilities29 In the news0 Timeline

Severity mix

Critical 0High 17Medium 12Low 0

Severity

All severities29 Critical0 High17 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add pfSense CE to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-111225	8.8	6%	Oct 15	Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh Affected: 2.5.0 through 2.9.0
CVE-2024-54780	8.8	13%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of… Affected: before 2.8.0
CVE-2026-97730	8.5	1%	Sep 25	In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an… Affected: before 2.9.0
CVE-2026-111224	7.5	5%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh Affected: through 2.9.0
CVE-2026-111231	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() Affected: through 2.9.0
CVE-2026-111229	7.2	6%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync Affected: 2.7.0 through 2.9.0
CVE-2026-111226	7.2	7%	Oct 15	Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php Affected: 2.4.5 through 2.9.0
CVE-2026-111223	7.2	1%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner Affected: 2.7.0 through 2.9.0
CVE-2026-111222	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting Affected: through 2.9.0
CVE-2026-111221	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection Affected: through 2.9.0
CVE-2026-111220	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid Affected: through 2.9.0
CVE-2026-111219	7.2	1%	Oct 15	Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username Affected: through 2.9.0
CVE-2026-111218	7.2	9%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters Affected: 2.7.0 through 2.9.0
CVE-2026-111217	7.2	7%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID Affected: through 2.9.0
CVE-2026-111216	7.2	5%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP Affected: through 2.9.0
CVE-2026-111215	7.2	6%	Oct 15	Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface Affected: through 2.9.0
CVE-2026-111214	7.2	11%	Oct 15	Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php Affected: 2.7.0 through 2.9.0