PF
Product
Pfsense
40
CVEs
0
On KEV
9.9
Max CVSS
16
New 30D
Severity mix
Critical 4High 15Medium 19Low 0
Watch
Add Pfsense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111225 | 8.8 | Oct 15 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh Affected: 2.5.0 through 2.9.0 |
| CVE-2021-41282 | 8.8 | Mar 1 | diag_routes.php in pfSense 2.5.2 allows sed data injection Affected: 2.5.2 |
| CVE-2016-10709 | 8.8 | Jan 22 | pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to… Affected: through 2.2.6 |
| CVE-2020-19678 | 7.5 | Apr 6 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter… Affected: 2.1.3 |
| CVE-2026-111231 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() Affected: through 2.9.0 |
| CVE-2026-111223 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner Affected: 2.7.0 through 2.9.0 |
| CVE-2026-111222 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting Affected: through 2.9.0 |
| CVE-2026-111221 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection Affected: through 2.9.0 |
| CVE-2026-111219 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username Affected: through 2.9.0 |
| CVE-2026-111218 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters Affected: 2.7.0 through 2.9.0 |
| CVE-2026-111217 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID Affected: through 2.9.0 |
| CVE-2026-111216 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP Affected: through 2.9.0 |
| CVE-2026-111215 | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface Affected: through 2.9.0 |
| CVE-2026-111214 | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php Affected: 2.7.0 through 2.9.0 |
| CVE-2023-29975 | 7.2 | Nov 9 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification Affected: 2.6.0 |
Showing 15