Netgate vulnerabilities

CVEs per yearBy the year they were published

1. 20183
2. 20259
3. 202626
4. 20262
5. 20262

Newest CVEs

• CVE-2026-111233

  Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

  Netgate · pfSense CE

  Low2.3
• CVE-2026-111232

  Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

  Netgate · pfSense CE

  Medium4.8
• CVE-2026-111231

  Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

  Netgate · pfSense CE

  High8.6
• CVE-2026-111230

  Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

  Netgate · pfSense CE

  Medium6.9
• CVE-2026-111229

  Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync

  Netgate · pfSense CE

  High8.6
• CVE-2026-111228

  Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

  Netgate · pfSense CE

  Medium5.1
• CVE-2026-111227

  Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

  Netgate · pfSense CE

  Medium5.1
• CVE-2026-111226

  Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

  Netgate · pfSense CE

  High8.6
• CVE-2026-111225

  Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

  Netgate · pfSense CE

  Low2.3
• CVE-2026-111224

  Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

  Netgate · pfSense CE

  High7.7