[ Vendor · 22 CVEs ]
Netgate
CVEs affecting Netgate published in the last 30 days, plus any Netgate CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111231 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because… | |
| CVE-2026-111232 | 15 Oct 2026 | CVSS 4.8 | Netgate pfSense CENetgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or… | |
| CVE-2026-111233 | 15 Oct 2026 | CVSS 6.1 | Netgate pfSense CENetgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to… | |
| CVE-2026-111224 | 15 Oct 2026 | CVSS 7.5 | Netgate pfSense CEpfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN… | |
| CVE-2026-111225 | 15 Oct 2026 | CVSS 8.8 | Netgate pfSense CENetgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN… | |
| CVE-2026-111226 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access… | |
| CVE-2026-111227 | 15 Oct 2026 | CVSS 5.5 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS… | |
| CVE-2026-111228 | 15 Oct 2026 | CVSS 5.5 | Netgate pfSense CENetgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users… | |
| CVE-2026-111229 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the… | |
| CVE-2026-111230 | 15 Oct 2026 | CVSS 4.9 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as… | |
| CVE-2026-111217 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to… | |
| CVE-2026-111218 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters… | |
| CVE-2026-111219 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject… | |
| CVE-2026-111220 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CEpfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands… | |
| CVE-2026-111221 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by… | |
| CVE-2026-111222 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject… | |
| CVE-2026-111223 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges… | Fix |
| CVE-2026-111214 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run… | |
| CVE-2026-111215 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by… | |
| CVE-2026-111216 | 15 Oct 2026 | CVSS 7.2 | Netgate pfSense CENetgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to… | |
| CVE-2026-110908 | 15 Oct 2026 | CVSS 8.8 | Netgate pfSense-pkg-frrNetgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status… | |
| CVE-2026-97730 | 25 Sep 2026 | CVSS 8.5 | Netgate pfSense PlusIn Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget… |