Vendor

    Netgate

    49 known vulnerabilities in products by Netgate, 0 of them actively exploited (CISA KEV).

    Key figures

    49

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Netgate
    HighCVE-2026-111214

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

    also in 2 other products

    		7.2
    HighCVE-2026-111218

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

    also in 2 other products

    		7.2
    HighCVE-2026-111217

    Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

    also in 2 other products

    		7.2
    HighCVE-2026-111215

    Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

    also in 2 other products

    		7.2
    HighCVE-2026-111216

    Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP

    also in 2 other products

    		7.2
    CriticalCVE-2022-40624

    Netgate Pfblockerng: security vulnerability

    		9.8
    HighCVE-2026-111225

    Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

    also in 2 other products

    		5.0
    CriticalCVE-2023-27100

    Netgate pfSense Plus: security vulnerability

    also in 1 other product

    		9.8
    HighCVE-2021-41282

    Netgate pfSense CE: Command Injection

    		8.8
    HighCVE-2016-10709

    Netgate pfSense CE: security vulnerability

    		8.8
    MediumCVE-2025-34175

    Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2025-34176

    Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

    also in 1 other product

    		4.3
    MediumCVE-2025-34174

    Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

    also in 1 other product

    		5.4
    HighCVE-2022-26019

    pfSense CE and pfSense Plus: Improper Access Control

    also in 2 other products

    		8.8
    MediumCVE-2026-111228

    Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

    also in 2 other products

    		5.5
    MediumCVE-2026-111227

    Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

    also in 2 other products

    		5.5
    MediumCVE-2021-27933

    Netgate pfSense CE: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2025-34178

    Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting

    also in 1 other product

    		5.4
    HighCVE-2020-19678

    OISF Suricata: Path Traversal

    also in 1 other product

    		7.5
    CriticalCVE-2023-29974

    Netgate pfSense CE: security vulnerability

    		9.8
    HighCVE-2026-111231

    Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

    also in 2 other products

    		7.2
    HighCVE-2026-111222

    Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting

    also in 2 other products

    		7.2
    HighCVE-2026-111223

    Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

    also in 2 other products

    		7.2
    HighCVE-2026-111221

    Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection

    also in 2 other products

    		7.2
    MediumCVE-2019-18667

    Pfsense Pfsense-pkg-freeradius3 0.15.7 3: Cross-Site Scripting (XSS)

    		6.1

    All vulnerabilities in search

    Products

    Products by Netgate
    Netgate pfSense CE400
    Pfsense Ce And Pfsense Plus30
    pfSense Suricata package30