NNetgate

Products

Exploited and recent CVEs

• CVE-2026-111233 Medium 4.7 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php 1.1%
• CVE-2026-111232 Medium 4.8 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color 1.0%
• CVE-2026-111231 High 7.2 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() 0.8%
• CVE-2026-111230 Medium 4.9 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL 0.8%
• CVE-2026-111229 High 7.2 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync 6.4%
• CVE-2026-111228 Medium 5.5 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php 1.8%
• CVE-2026-111227 Medium 5.5 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php 1.8%
• CVE-2026-111226 High 7.2 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php 6.5%
• CVE-2026-111225 Medium 5.0 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh 6.2%
• CVE-2026-111224 High 7.5 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh 5.4%
• CVE-2026-111223 High 7.2 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner 0.8%
• CVE-2026-111222 Medium 6.6 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting 1.0%
• CVE-2026-111221 Medium 6.6 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection 0.9%
• CVE-2026-111220 High 7.2 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid 0.7%
• CVE-2026-111219 Medium 6.6 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username 0.9%
• CVE-2026-111218 High 7.2 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters 8.6%
• CVE-2026-111217 High 7.2 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID 7.0%
• CVE-2026-111216 High 7.2 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP 4.7%
• CVE-2026-111215 High 7.2 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface 6.2%
• CVE-2026-111214 High 7.2 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php 10.8%
• CVE-2026-110908 High 8.8 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the pag 6.1%
• CVE-2026-97730 High 8.5 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker 1.0%
• CVE-2026-97730 High 8.5 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker 1.0%
• CVE-2026-56128 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php 1.1%
• CVE-2026-56128 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php 1.1%
• CVE-2026-56127 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php 1.1%
• CVE-2026-56127 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php 1.1%
• CVE-2026-56126 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php 1.1%
• CVE-2026-56126 Medium 5.4 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php 1.1%
• CVE-2026-67189 Medium 6.1 pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record 1.2%