Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward p…Check if you run itEPSS 1.00%Oct 15, 2026
- Medium5.1Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lis…Check if you run itEPSS 1.84%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submi…Check if you run itEPSS 0.96%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unesc…Check if you run itEPSS 0.94%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via un…Check if you run itEPSS 0.87%Oct 15, 2026
- High8.6Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execut…Check if you run itEPSS 8.65%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as…Check if you run itEPSS 6.96%Oct 15, 2026
- High8.8Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter.Check if you run itEPSS 6.08%Oct 15, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.Check if you run itEPSS 0.68%May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.Check if you run itEPSS 0.81%May 8, 2026
- High8.8Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability.Check this weekEPSS 16.95%Nov 6, 2025
- Medium5.1In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings beCheck this weekEPSS 14.48%Sep 9, 2025
- Medium5.0In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal.Check if you run itEPSS 1.91%Jun 28, 2025
- Medium5.4Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, alloCheck if you run itEPSS 1.28%May 14, 2025
- High8.8Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-suppliCheck this weekEPSS 12.73%May 14, 2025
- Medium5.4Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.Check if you run itEPSS 8.52%May 14, 2025
- Unknownnetgate pfblockerng Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 91.88%Sep 18, 2024
Sort
17 records