pfSense Plus vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

PP

Product

pfSense Plus

by Netgate · last CVE Sep 25, 2026

15

CVEs

0

On KEV

9.8

Max CVSS

0

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 1High 6Medium 8Low 0

Severity

All severities15 Critical1 High6 Medium8 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add pfSense Plus to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-27100	9.8	10%	Mar 22	Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to… Affected: 22.05.1
CVE-2024-54780	8.8	13%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of… Affected: before 25.03
CVE-2023-48123	8.8	68%	Dec 6	An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php… Affected: through 23.05.1
CVE-2023-42326	8.8	64%	Nov 14	An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components Affected: through 23.05.1
CVE-2022-26019	8.8	4%	Mar 31	Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… Affected: before 22.01
CVE-2022-24299	8.8	2%	Mar 31	Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… Affected: before 22.01
CVE-2026-97730	8.5	1%	Sep 25	In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an… Affected: before 26.07
CVE-2026-67189	6.1	1%	Aug 19	pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record Affected: before 26.07
CVE-2021-20729	6.1	3%	Mar 31	Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… Affected: through 21.05
CVE-2023-48795	5.9	94%	Dec 18	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: through 23.09.1
CVE-2026-56128	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php Affected: before 26.07
CVE-2026-56127	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php Affected: before 26.07
CVE-2026-56126	5.4	1%	Sep 3	pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php Affected: before 26.07
CVE-2024-57273	5.4	1%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service,… Affected: before 25.03
CVE-2024-54779	5.4	9%	May 14	Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php Affected: before 25.03