PF
Vendor
Pfsense
49
CVEs
0
On KEV
16
New 30D
Products
PF9.9
Pfsense
Pfsense
40 CVEs0 on KEV16 new
SP7.5
Suricata Package
Pfsense
3 CVEs0 on KEV0 new
SP–
Snort Package
Pfsense
2 CVEs0 on KEV0 new
PF9.8
Pfblockerng
Pfsense
1 CVEs0 on KEV0 new
PF6.1
Pfsense-pkg-freeradius3
Pfsense
1 CVEs0 on KEV0 new
PF6.5
Pfsense-pkg-wireguard
Pfsense
1 CVEs0 on KEV0 new
PP6.1
Pfsense Plus
Pfsense
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111233 | PF Pfsense Pfsense | 6.1 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php |
| CVE-2026-111232 | PF Pfsense Pfsense | 4.8 | Oct 15 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color |
| CVE-2026-111231 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() |
| CVE-2026-111230 | PF Pfsense Pfsense | 4.9 | Oct 15 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL |
| CVE-2026-111228 | PF Pfsense Pfsense | 5.5 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php |
| CVE-2026-111227 | PF Pfsense Pfsense | 5.5 | Oct 15 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php |
| CVE-2026-111225 | PF Pfsense Pfsense | 8.8 | Oct 15 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh |
| CVE-2026-111223 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner |
| CVE-2026-111222 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting |
| CVE-2026-111221 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection |
| CVE-2026-111219 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username |
| CVE-2026-111218 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters |
| CVE-2026-111217 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID |
| CVE-2026-111216 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP |
| CVE-2026-111215 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface |
| CVE-2026-111214 | PF Pfsense Pfsense | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php |
| CVE-2025-69690 | PF Pfsense Pfsense | 9.1 | May 8 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property |
| CVE-2025-69691 | PF Pfsense Pfsense | 9.9 | May 8 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php |
| CVE-2025-34178 | PF Pfsense Pfsense | 5.4 | Sep 9 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed |
| CVE-2025-34177 | PF Pfsense Pfsense | 5.4 | Sep 9 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed |
| CVE-2025-34176 | PF Pfsense Pfsense | 4.3 | Sep 9 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters |
| CVE-2025-34175 | PF Pfsense Pfsense | 6.1 | Sep 9 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings |
| CVE-2025-34174 | PF Pfsense Pfsense | 5.4 | Sep 9 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings… |
| CVE-2025-34173 | PF Pfsense Pfsense | 4.3 | Sep 9 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used… |
| CVE-2025-34172 | PF Pfsense Pfsense | 6.1 | Sep 9 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests |
| CVE-2025-53392 | PF Pfsense Pfsense | 6.5 | Jun 28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal |
| CVE-2023-29975 | PF Pfsense Pfsense | 7.2 | Nov 9 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification |
| CVE-2023-29974 | PF Pfsense Pfsense | 9.8 | Nov 8 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements |
| CVE-2023-29973 | PF Pfsense Pfsense | 4.9 | Oct 25 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall |
| CVE-2020-19678 | PF Pfsense Pfsense | 7.5 | Apr 6 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter… |
| CVE-2023-27100 | PF Pfsense Pfsense | 9.8 | Mar 22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to… |
| CVE-2022-40624 | PF Pfblockerng Pfsense | 9.8 | Dec 20 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814 |
| CVE-2022-42247 | PF Pfsense Pfsense | 6.1 | Oct 3 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component |
| CVE-2021-20729 | PF Pfsense Pfsense | 6.1 | Mar 31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… |
| CVE-2022-21132 | PF Pfsense-pkg-wireguard Pfsense | 6.5 | Mar 10 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a… |
| CVE-2021-41282 | PF Pfsense Pfsense | 8.8 | Mar 1 | diag_routes.php in pfSense 2.5.2 allows sed data injection |
| CVE-2022-23993 | PF Pfsense Pfsense | 6.1 | Jan 26 | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS |
| CVE-2020-26693 | PF Pfsense Pfsense | 5.4 | Jun 1 | A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of… |
| CVE-2021-27933 | PF Pfsense Pfsense | 6.1 | Apr 28 | pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field |
| CVE-2019-18667 | PF Pfsense-pkg-freeradius3 Pfsense | 6.1 | Nov 2 | /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute… |
| CVE-2016-10709 | PF Pfsense Pfsense | 8.8 | Jan 22 | pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to… |
| CVE-2014-4696 | SP Suricata Package Pfsense | – | Jul 2 | Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct… |
| CVE-2014-4695 | SP Snort Package Pfsense | – | Jul 2 | Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct… |
| CVE-2014-4694 | SP Suricata Package Pfsense | – | Jul 2 | Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject… |
| CVE-2014-4693 | SP Snort Package Pfsense | – | Jul 2 | Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via… |
| CVE-2011-5047 | PF Pfsense Pfsense | – | Jan 3 | Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter |
| CVE-2011-4197 | PF Pfsense Pfsense | – | Jan 3 | etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to… |