CVE Tools
Track your stack

pfSense CE

36 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for pfSense CE, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

pfSense CE CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
pfSense CE CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-053
2025-060
2025-070
2025-080
2025-097
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-081
2026-094
2026-1020

Severity

How the 36 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High1336%
  • Medium2364%

Latest CVEs

The 15 most recently published vulnerabilities affecting pfSense CE.

  1. CVE-2026-111233Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php4.7
  2. CVE-2026-111232Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color4.8
  3. CVE-2026-111231Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()7.2
  4. CVE-2026-111229Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync7.2
  5. CVE-2026-111230Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL4.9
  6. CVE-2026-111228Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php5.5
  7. CVE-2026-111227Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php5.5
  8. CVE-2026-111226Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php7.2
  9. CVE-2026-111225Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh5.0
  10. CVE-2026-111224Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh7.5
  11. CVE-2026-111222Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting6.6
  12. CVE-2026-111223Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner7.2
  13. CVE-2026-111220Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid7.2
  14. CVE-2026-111221Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection6.6
  15. CVE-2026-111219Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username6.6

Product grouping is registry-driven, with AI assist and human review. How it works