Product by Netgate
Pfsense Ce
37 known vulnerabilities in Pfsense Ce (Netgate), 0 of them actively exploited (CISA KEV).
Key figures
37
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-111214 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php | 7.2 | |
| High | CVE-2026-111218 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters | 7.2 | |
| High | CVE-2026-111217 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID | 7.2 | |
| High | CVE-2026-110908 | Netgate pfSense-pkg-frr: OS Command Injection | 8.8 | |
| High | CVE-2026-111226 | Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php | 7.2 | |
| High | CVE-2026-111229 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync | 7.2 | |
| High | CVE-2026-111215 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface | 7.2 | |
| High | CVE-2026-111216 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP | 7.2 | |
| High | CVE-2026-111224 | Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh | 7.5 | |
| High | CVE-2024-54780 | Netgate pfSense CE: Command Injection | 8.8 | |
| High | CVE-2026-111225 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh | 5.0 | |
| Medium | CVE-2025-34175 | Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting | 6.1 | |
| Medium | CVE-2023-48795 | SSH Communications Security SSH daemon: security vulnerability | 5.9 | |
| Medium | CVE-2025-34176 | Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure | 4.3 | |
| Medium | CVE-2025-34174 | Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting | 5.4 | |
| Medium | CVE-2024-54779 | Netgate pfSense CE: Cross-Site Scripting (XSS) | 5.4 | |
| Medium | CVE-2026-111228 | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php | 5.5 | |
| Medium | CVE-2026-111227 | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php | 5.5 | |
| Medium | CVE-2025-34178 | Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting | 5.4 | |
| High | CVE-2026-97730 | Netgate pfSense Plus: Path Traversal: '../filedir' | 8.5 | |
| High | CVE-2026-111231 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() | 7.2 | |
| High | CVE-2026-111222 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting | 7.2 | |
| High | CVE-2026-111221 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection | 7.2 | |
| High | CVE-2026-111223 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner | 7.2 | |
| High | CVE-2026-111220 | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid | 7.2 |