NE
Vendor
Netgate
113
CVEs
0
On KEV
21
New 30D
Products
PC8.8
pfSense CE
Netgate
36 CVEs0 on KEV20 new
PF8.8
pfSense-pkg-frr
Netgate
1 CVEs0 on KEV1 new
PF9.8
pfSense
Netgate
51 CVEs0 on KEV0 new
PP9.8
pfSense Plus
Netgate
15 CVEs0 on KEV0 new
AA7.8
Amiti Antivirus
Netgate
2 CVEs0 on KEV0 new
AC6.1
Acme
Netgate
1 CVEs0 on KEV0 new
DB7.8
Data Backup
NETGATE
1 CVEs0 on KEV0 new
HA6.1
Haproxy
Netgate
1 CVEs0 on KEV0 new
NA7.8
NETGATE AMITI Antivirus
Netgate
1 CVEs0 on KEV0 new
NR7.8
NETGATE Registry Cleaner
Netgate
1 CVEs0 on KEV0 new
PF9.8
Pfblockerng
Netgate
1 CVEs0 on KEV0 new
PA9.6
Pfsense Acme Package
Netgate
1 CVEs0 on KEV0 new
RC7.8
Registry Cleaner
Netgate
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111233 | PC pfSense CE Netgate | 6.1 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php |
| CVE-2026-111232 | PC pfSense CE Netgate | 4.8 | Oct 15 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color |
| CVE-2026-111231 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() |
| CVE-2026-111230 | PC pfSense CE Netgate | 4.9 | Oct 15 | Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL |
| CVE-2026-111229 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync |
| CVE-2026-111228 | PC pfSense CE Netgate | 5.5 | Oct 15 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php |
| CVE-2026-111227 | PC pfSense CE Netgate | 5.5 | Oct 15 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php |
| CVE-2026-111226 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php |
| CVE-2026-111225 | PC pfSense CE Netgate | 8.8 | Oct 15 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh |
| CVE-2026-111224 | PC pfSense CE Netgate | 7.5 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh |
| CVE-2026-111223 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner |
| CVE-2026-111222 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting |
| CVE-2026-111221 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection |
| CVE-2026-111220 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid |
| CVE-2026-111219 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username |
| CVE-2026-111218 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters |
| CVE-2026-111217 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID |
| CVE-2026-111216 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP |
| CVE-2026-111215 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface |
| CVE-2026-111214 | PC pfSense CE Netgate | 7.2 | Oct 15 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php |
| CVE-2026-110908 | PF pfSense-pkg-frr Netgate | 8.8 | Oct 15 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter |
| CVE-2026-97730 | PC pfSense CE Netgate | 8.5 | Sep 25 | In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an… |
| CVE-2026-56128 | PP pfSense Plus Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php |
| CVE-2026-56127 | PP pfSense Plus Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php |
| CVE-2026-56126 | PP pfSense Plus Netgate | 5.4 | Sep 3 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php |
| CVE-2026-67189 | PP pfSense Plus Netgate | 6.1 | Aug 19 | pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record |
| CVE-2016-20058 | NA NETGATE AMITI Antivirus Netgate | 7.8 | Apr 4 | Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation |
| CVE-2016-20057 | NR NETGATE Registry Cleaner Netgate | 7.8 | Apr 4 | NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation |
| CVE-2019-25271 | DB Data Backup NETGATE | 7.8 | Feb 4 | NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path |
| CVE-2019-25269 | AA Amiti Antivirus Netgate | 7.8 | Feb 4 | Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability |
| CVE-2025-12490 | PF pfSense Netgate | 8.8 | Nov 6 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability |
| CVE-2025-34178 | PC pfSense CE Netgate | 5.4 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting |
| CVE-2025-34177 | PC pfSense CE Netgate | 5.4 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting |
| CVE-2025-34176 | PC pfSense CE Netgate | 4.3 | Sep 9 | Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure |
| CVE-2025-34175 | PC pfSense CE Netgate | 6.1 | Sep 9 | Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting |
| CVE-2025-34174 | PC pfSense CE Netgate | 5.4 | Sep 9 | Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting |
| CVE-2025-34173 | PC pfSense CE Netgate | 4.3 | Sep 9 | Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure |
| CVE-2025-34172 | PC pfSense CE Netgate | 6.1 | Sep 9 | Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting |
| CVE-2025-53392 | PF pfSense Netgate | 6.5 | Jun 28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal |
| CVE-2024-57273 | PC Pfsense CE Netgate | 5.4 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service,… |
| CVE-2024-54780 | PP Pfsense Plus Netgate | 8.8 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of… |
| CVE-2024-54779 | PC Pfsense CE Netgate | 5.4 | May 14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php |
| CVE-2024-46538 | PF Pfsense Netgate | 4.8 | Oct 22 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at… |
| CVE-2023-48795 | PP Pfsense Plus Netgate | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… |
| CVE-2023-48123 | PP Pfsense Plus Netgate | 8.8 | Dec 6 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php… |
| CVE-2023-42326 | PF Pfsense Netgate | 8.8 | Nov 14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components |
| CVE-2023-42327 | PF Pfsense Netgate | 5.4 | Nov 14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page |
| CVE-2023-42325 | PF Pfsense Netgate | 5.4 | Nov 14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page |
| CVE-2020-21487 | PA Pfsense Acme Package Netgate | 9.6 | Apr 4 | Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of… |
| CVE-2023-27100 | PP Pfsense Plus Netgate | 9.8 | Mar 22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to… |
| CVE-2023-27253 | PF Pfsense Netgate | 8.8 | Mar 17 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the… |
| CVE-2022-29273 | PF Pfsense Netgate | 6.1 | Feb 22 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters |
| CVE-2020-21219 | AC Acme Netgate | 6.1 | Dec 15 | Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder… |
| CVE-2022-31814 | PF Pfblockerng Netgate | 9.8 | Sep 5 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header |
| CVE-2022-26019 | PP Pfsense Plus Netgate | 8.8 | Mar 31 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… |
| CVE-2022-24299 | PP Pfsense Plus Netgate | 8.8 | Mar 31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… |
| CVE-2021-20729 | PP Pfsense Plus Netgate | 6.1 | Mar 31 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a… |
| CVE-2020-19203 | PF Pfsense Netgate | 5.4 | Jul 12 | An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and… |
| CVE-2020-19201 | PF Pfsense Netgate | 5.4 | Jul 12 | A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier |
| CVE-2020-10797 | PF Pfsense Netgate | 6.1 | Apr 29 | An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version |