PF
Product
Pfsense
40
CVEs
0
On KEV
9.9
Max CVSS
16
New 30D
Severity mix
Critical 4High 15Medium 19Low 0
Watch
Add Pfsense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-69691 | 9.9 | May 8 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php Affected: 2.8.0 |
| CVE-2023-29974 | 9.8 | Nov 8 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements Affected: 2.6.0 |
| CVE-2023-27100 | 9.8 | Mar 22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to… Affected: 2.6.0 |
| CVE-2025-69690 | 9.1 | May 8 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property Affected: 2.7.2 |
| CVE-2026-111225 | 8.8 | Oct 15 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh Affected: 2.5.0 through 2.9.0 |
| CVE-2021-41282 | 8.8 | Mar 1 | diag_routes.php in pfSense 2.5.2 allows sed data injection Affected: 2.5.2 |
| CVE-2016-10709 | 8.8 | Jan 22 | pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to… Affected: through 2.2.6 |
| CVE-2020-19678 | 7.5 | Apr 6 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter… Affected: 2.1.3 |
| CVE-2026-111231 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() Affected: through 2.9.0 |
| CVE-2026-111223 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner Affected: 2.7.0 through 2.9.0 |
| CVE-2026-111222 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting Affected: through 2.9.0 |
| CVE-2026-111221 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection Affected: through 2.9.0 |
| CVE-2026-111219 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username Affected: through 2.9.0 |
| CVE-2026-111218 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters Affected: 2.7.0 through 2.9.0 |
| CVE-2026-111217 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID Affected: through 2.9.0 |
| CVE-2026-111216 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP Affected: through 2.9.0 |
| CVE-2026-111215 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface Affected: through 2.9.0 |
| CVE-2026-111214 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php Affected: 2.7.0 through 2.9.0 |
| CVE-2023-29975 | 7.2 | Nov 9 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification Affected: 2.6.0 |
| CVE-2025-53392 | 6.5 | Jun 28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal Affected: 2.8.0 |
| CVE-2026-111233 | 6.1 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php Affected: 2.7.1 through 2.9.0 |
| CVE-2025-34175 | 6.1 | Sep 9 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings Affected: before 2.8.0 |
| CVE-2025-34172 | 6.1 | Sep 9 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests Affected: before 2.8.0 |
| CVE-2022-42247 | 6.1 | Oct 3 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component Affected: 2.5.2 |
| CVE-2021-20729 | 6.1 | Mar 31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… Affected: through 2.5.2 |
| CVE-2022-23993 | 6.1 | Jan 26 | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS Affected: before 2.6.0 |
| CVE-2021-27933 | 6.1 | Apr 28 | pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field Affected: 2.5.0 |
| CVE-2026-111228 | 5.5 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php Affected: 2.7.1 through 2.9.0 |
| CVE-2026-111227 | 5.5 | Oct 15 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php Affected: through 2.9.0 |
| CVE-2025-34178 | 5.4 | Sep 9 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed Affected: before 2.8.0 |
| CVE-2025-34177 | 5.4 | Sep 9 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed Affected: before 2.8.0 |
| CVE-2025-34174 | 5.4 | Sep 9 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings… Affected: before 2.8.0 |
| CVE-2020-26693 | 5.4 | Jun 1 | A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of… Affected: 2.4.5 |
| CVE-2026-111230 | 4.9 | Oct 15 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL Affected: through 2.9.0 |
| CVE-2023-29973 | 4.9 | Oct 25 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall Affected: 2.6.0 |
| CVE-2026-111232 | 4.8 | Oct 15 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color Affected: 2.3.0 through 2.9.0 |
| CVE-2025-34176 | 4.3 | Sep 9 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters Affected: before 2.8.0 |
| CVE-2025-34173 | 4.3 | Sep 9 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used… Affected: before 2.8.0 |
| CVE-2011-5047 | – | Jan 3 | Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter Affected: through 2.0; 1.0.x; 1.2.1; 1.2.2; 1.2.3 |
| CVE-2011-4197 | – | Jan 3 | etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to… Affected: through 2.0; 1.0.x; 1.2.1; 1.2.2; 1.2.3 |
Showing 40