pfSense security vulnerabilities
Networking / NAS. Public CVE monitoring for pfSense. Vendor security advisories are linked on this page.
Built for Operators of this product.
17 public records · 0 security-fix timeline events. 0 published in the last 7 days. 15 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 6
- Medium 2
- Low 0
2026-08-058 issues2026-11-02
Known exploited
View all known exploitedRecently published
Browse catalog- High8.8Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter.Check if you run itEPSS 6.08%Oct 15, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.Check if you run itEPSS 0.68%May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.Check if you run itEPSS 0.81%May 8, 2026
- High8.8Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability.Check this weekEPSS 16.95%Nov 6, 2025
- Medium5.1In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings beCheck this weekEPSS 14.48%Sep 9, 2025
- Medium5.0In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal.Check if you run itEPSS 1.91%Jun 28, 2025
- High8.8Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-suppliCheck this weekEPSS 12.73%May 14, 2025
- Medium5.4Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, alloCheck if you run itEPSS 1.28%May 14, 2025
- Medium5.4Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.Check if you run itEPSS 8.52%May 14, 2025