CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product netgate:pfsense_ce. Show all products

26 CVEs, showing 1 to 26
CVESeverityTitlePublished
CVE-2023-48795Medium 5.9The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
Assigned by mitre
Dec 18, 2023
CVE-2026-67189Medium 6.1pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
Assigned by VulnCheck
Aug 19, 2026
CVE-2026-56126Medium 5.4pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-56127Medium 5.4pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-56128Medium 5.4pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
Assigned by VulnCheck
Sep 3, 2026
CVE-2026-97730High 8.5In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacke…
Assigned by mitre
Sep 25, 2026
CVE-2026-111214High 7.2Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111215High 7.2Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111216High 7.2Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111217High 7.2Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111218High 7.2Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111219Medium 6.6Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111220High 7.2Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111221Medium 6.6Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111222Medium 6.6Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111223High 7.2Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111224High 7.5Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111225Medium 5.0Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111226High 7.2Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111227Medium 5.5Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111228Medium 5.5Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111229High 7.2Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111230Medium 4.9Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111231High 7.2Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111232Medium 4.8Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
Assigned by VulnCheck
Oct 15, 2026
CVE-2026-111233Medium 4.7Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
Assigned by VulnCheck
Oct 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.