NE
Vendor
Netgate
103
CVEs
0
On KEV
21
New 30D
Products
PC8.8
pfSense CE
Netgate
29 CVEs0 on KEV20 new
PF8.8
pfSense-pkg-frr
Netgate
1 CVEs0 on KEV1 new
PF9.8
Pfsense
Netgate
49 CVEs0 on KEV0 new
PP9.8
pfSense Plus
Netgate
15 CVEs0 on KEV0 new
AA7.8
Amiti Antivirus
Netgate
2 CVEs0 on KEV0 new
AC6.1
Acme
Netgate
1 CVEs0 on KEV0 new
HA6.1
Haproxy
Netgate
1 CVEs0 on KEV0 new
NA7.8
NETGATE AMITI Antivirus
Netgate
1 CVEs0 on KEV0 new
NR7.8
NETGATE Registry Cleaner
Netgate
1 CVEs0 on KEV0 new
PF9.8
Pfblockerng
Netgate
1 CVEs0 on KEV0 new
PA9.6
Pfsense Acme Package
Netgate
1 CVEs0 on KEV0 new
RC7.8
Registry Cleaner
Netgate
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111233 | PC pfSense CE Netgate | 6.1 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php |
| CVE-2026-111232 | PC pfSense CE Netgate | 4.8 | Oct 15 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color |
| CVE-2026-111231 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() |
| CVE-2026-111230 | PC pfSense CE Netgate | 4.9 | Oct 15 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL |
| CVE-2026-111229 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync |
| CVE-2026-111228 | PC pfSense CE Netgate | 5.5 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php |
| CVE-2026-111227 | PC pfSense CE Netgate | 5.5 | Oct 15 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php |
| CVE-2026-111226 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php |
| CVE-2026-111225 | PC pfSense CE Netgate | 8.8 | Oct 15 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh |
| CVE-2026-111224 | PC pfSense CE Netgate | 7.5 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh |
| CVE-2026-111223 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner |
| CVE-2026-111222 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting |
| CVE-2026-111221 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection |
| CVE-2026-111220 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid |
| CVE-2026-111219 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username |
| CVE-2026-111218 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters |
| CVE-2026-111217 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID |
| CVE-2026-111216 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP |
| CVE-2026-111215 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface |
| CVE-2026-111214 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php |
| CVE-2026-110908 | PF pfSense-pkg-frr Netgate | 8.8 | Oct 15 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter |
| CVE-2026-97730 | PC pfSense CE Netgate | 8.5 | Sep 25 | In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an… |
| CVE-2026-56128 | PP pfSense Plus Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php |
| CVE-2026-56127 | PP pfSense Plus Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php |
| CVE-2026-56126 | PC pfSense CE Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php |
| CVE-2026-67189 | PP pfSense Plus Netgate | 6.1 | Aug 19 | pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record |
| CVE-2016-20058 | NA NETGATE AMITI Antivirus Netgate | 7.8 | Apr 4 | Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation |
| CVE-2016-20057 | NR NETGATE Registry Cleaner Netgate | 7.8 | Apr 4 | NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation |
| CVE-2019-25269 | AA Amiti Antivirus Netgate | 7.8 | Feb 4 | Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability |
| CVE-2024-57273 | PC Pfsense CE Netgate | 5.4 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service,… |
| CVE-2024-54780 | PC Pfsense CE Netgate | 8.8 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of… |
| CVE-2024-54779 | PC Pfsense CE Netgate | 5.4 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php |
| CVE-2024-46538 | PF Pfsense Netgate | 4.8 | Oct 22 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at… |
| CVE-2023-48795 | PP Pfsense Plus Netgate | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… |
| CVE-2023-48123 | PF Pfsense Netgate | 8.8 | Dec 6 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php… |
| CVE-2023-42326 | PF Pfsense Netgate | 8.8 | Nov 14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components |
| CVE-2023-42327 | PF Pfsense Netgate | 5.4 | Nov 14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page |
| CVE-2023-42325 | PF Pfsense Netgate | 5.4 | Nov 14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page |
| CVE-2020-21487 | PF Pfsense Netgate | 9.6 | Apr 4 | Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of… |
| CVE-2023-27100 | PP Pfsense Plus Netgate | 9.8 | Mar 22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to… |
| CVE-2023-27253 | PF Pfsense Netgate | 8.8 | Mar 17 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the… |
| CVE-2022-29273 | PF Pfsense Netgate | 6.1 | Feb 22 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters |
| CVE-2020-21219 | AC Acme Netgate | 6.1 | Dec 15 | Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder… |
| CVE-2022-31814 | PF Pfblockerng Netgate | 9.8 | Sep 5 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header |
| CVE-2022-26019 | PP Pfsense Plus Netgate | 8.8 | Mar 31 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… |
| CVE-2022-24299 | PF Pfsense Netgate | 8.8 | Mar 31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… |
| CVE-2021-20729 | PP Pfsense Plus Netgate | 6.1 | Mar 31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… |
| CVE-2020-19203 | PF Pfsense Netgate | 5.4 | Jul 12 | An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and… |
| CVE-2020-19201 | PF Pfsense Netgate | 5.4 | Jul 12 | A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier |
| CVE-2020-10797 | PF Pfsense Netgate | 6.1 | Apr 29 | An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version |
| CVE-2020-11457 | PF Pfsense Netgate | 5.4 | Apr 1 | pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user |
| CVE-2019-16667 | PF Pfsense Netgate | 8.8 | Sep 26 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands |
| CVE-2019-16915 | PF Pfsense Netgate | 9.8 | Sep 26 | An issue was discovered in pfSense through 2.4.4-p3 |
| CVE-2019-16914 | PF Pfsense Netgate | 6.1 | Sep 26 | An XSS issue was discovered in pfSense through 2.4.4-p3 |
| CVE-2019-16701 | PF Pfsense Netgate | 8.8 | Sep 25 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value |
| CVE-2019-12949 | PF Pfsense Netgate | 6.1 | Jun 25 | In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload… |
| CVE-2019-12585 | PF Pfsense Netgate | 9.8 | Jun 3 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php |
| CVE-2019-12584 | PF Pfsense Netgate | 6.1 | Jun 3 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php |
| CVE-2019-12347 | PF Pfsense Netgate | 6.1 | May 29 | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action |
| CVE-2019-11816 | PF Pfsense Netgate | 7.2 | May 20 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via… |