pfSense CE vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

PC

Product

pfSense CE

by Netgate · last CVE Oct 15, 2026

36

CVEs

0

On KEV

8.8

Max CVSS

20

New 30D

Vulnerabilities36 In the news0 Timeline

Severity mix

Critical 0High 17Medium 19Low 0

Severity

All severities36 Critical0 High17 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add pfSense CE to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-111233	6.1	1%	Oct 15	Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php Affected: 2.7.1 through 2.9.0
CVE-2026-67189	6.1	1%	Aug 19	pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record Affected: through 2.8.1
CVE-2025-34175	6.1	21%	Sep 9	Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting Affected: 7.0.8_2
CVE-2025-34172	6.1	1%	Sep 9	Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting Affected: 0.63_10
CVE-2023-48795	5.9	94%	Dec 18	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: through 2.7.2
CVE-2026-111228	5.5	2%	Oct 15	Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php Affected: 2.7.1 through 2.9.0
CVE-2026-111227	5.5	2%	Oct 15	Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php Affected: through 2.9.0
CVE-2026-56128	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php Affected: before 2.9.0
CVE-2026-56127	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php Affected: before 2.9.0
CVE-2026-56126	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php Affected: before 2.9.0
CVE-2025-34178	5.4	5%	Sep 9	Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting Affected: 7.0.8_2
CVE-2025-34177	5.4	1%	Sep 9	Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting Affected: 7.0.8_2
CVE-2025-34174	5.4	14%	Sep 9	Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting Affected: 2.3.2_7
CVE-2024-57273	5.4	1%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service,… Affected: before 2.8.0
CVE-2024-54779	5.4	9%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php Affected: before 2.8.0
CVE-2026-111230	4.9	1%	Oct 15	Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL Affected: through 2.9.0
CVE-2026-111232	4.8	1%	Oct 15	Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color Affected: 2.3.0 through 2.9.0
CVE-2025-34176	4.3	17%	Sep 9	Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure Affected: 7.0.8_2
CVE-2025-34173	4.3	1%	Sep 9	Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure Affected: 4.1.6_25