Pfsense ce

This hub aggregates every CVE we track for Pfsense ce, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Pfsense ce.

• CVE-2026-56128pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php5.4Sep 3, 2026
• CVE-2026-56127pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php5.4Sep 3, 2026
• CVE-2026-56126pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php5.4Sep 3, 2026
• CVE-2026-67189pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record6.1Aug 19, 2026
• CVE-2025-34178Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting5.4Sep 9, 2025
• CVE-2025-34177Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting5.4Sep 9, 2025
• CVE-2025-34176Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure4.3Sep 9, 2025
• CVE-2025-34175Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting6.1Sep 9, 2025
• CVE-2025-34174Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting5.4Sep 9, 2025
• CVE-2025-34173Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure4.3Sep 9, 2025
• CVE-2025-34172Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting6.1Sep 9, 2025
• CVE-2024-57273Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attac...5.4May 14, 2025
• CVE-2024-54780Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the O...8.8May 14, 2025
• CVE-2024-54779Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.5.4May 14, 2025
• CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (fr...5.9Dec 18, 2023