PF
Product
Pfsense
41
CVEs
0
On KEV
9.9
Max CVSS
16
New 30D
Severity mix
Critical 4High 15Medium 20Low 0
Watch
Add Pfsense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53392 | 6.5 | Jun 28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal Affected: 2.8.0 |
| CVE-2026-111233 | 6.1 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php Affected: 2.7.1 through 2.9.0 |
| CVE-2025-34175 | 6.1 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting Affected: before 2.8.0 |
| CVE-2025-34172 | 6.1 | Sep 9 | Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting Affected: before 2.8.0 |
| CVE-2022-42247 | 6.1 | Oct 3 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component Affected: 2.5.2 |
| CVE-2021-20729 | 6.1 | Mar 31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… Affected: through 2.5.2 |
| CVE-2022-23993 | 6.1 | Jan 26 | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS Affected: before 2.6.0 |
| CVE-2021-27933 | 6.1 | Apr 28 | pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field Affected: 2.5.0 |
| CVE-2026-111228 | 5.5 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php Affected: 2.7.1 through 2.9.0 |
| CVE-2026-111227 | 5.5 | Oct 15 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php Affected: through 2.9.0 |
| CVE-2025-34178 | 5.4 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting Affected: before 2.8.0 |
| CVE-2025-34177 | 5.4 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting Affected: before 2.8.0 |
| CVE-2025-34174 | 5.4 | Sep 9 | Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting Affected: before 2.8.0 |
| CVE-2020-26693 | 5.4 | Jun 1 | A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of… Affected: 2.4.5 |
| CVE-2026-111230 | 4.9 | Oct 15 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL Affected: through 2.9.0 |
| CVE-2023-29973 | 4.9 | Oct 24 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall Affected: 2.6.0 |
| CVE-2026-111232 | 4.8 | Oct 15 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color Affected: 2.3.0 through 2.9.0 |
| CVE-2024-46538 | 4.8 | Oct 22 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at… Affected: 2.5.2 |
| CVE-2025-34176 | 4.3 | Sep 9 | Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure Affected: before 2.8.0 |
| CVE-2025-34173 | 4.3 | Sep 9 | Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure Affected: before 2.8.0 |
Showing 20