# Netgate pfSense CE.

Every CVE that names Netgate pfSense CE among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php](https://agentprime.io/advisories/CVE-2026-111233.md)
  `CVE-2026-111233` · CVE record: Netgate pfSense CE · CVSS 2.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color](https://agentprime.io/advisories/CVE-2026-111232.md)
  `CVE-2026-111232` · CVE record: Netgate pfSense CE · CVSS 4.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL](https://agentprime.io/advisories/CVE-2026-111230.md)
  `CVE-2026-111230` · CVE record: Netgate pfSense CE · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php](https://agentprime.io/advisories/CVE-2026-111228.md)
  `CVE-2026-111228` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php](https://agentprime.io/advisories/CVE-2026-111227.md)
  `CVE-2026-111227` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php](https://agentprime.io/advisories/CVE-2026-111226.md)
  `CVE-2026-111226` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh](https://agentprime.io/advisories/CVE-2026-111225.md)
  `CVE-2026-111225` · CVE record: Netgate pfSense CE · CVSS 2.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh](https://agentprime.io/advisories/CVE-2026-111224.md)
  `CVE-2026-111224` · CVE record: Netgate pfSense CE · CVSS 7.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner](https://agentprime.io/advisories/CVE-2026-111223.md)
  `CVE-2026-111223` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting](https://agentprime.io/advisories/CVE-2026-111222.md)
  `CVE-2026-111222` · CVE record: Netgate pfSense CE · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid](https://agentprime.io/advisories/CVE-2026-111220.md)
  `CVE-2026-111220` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username](https://agentprime.io/advisories/CVE-2026-111219.md)
  `CVE-2026-111219` · CVE record: Netgate pfSense CE · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection
- [Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters](https://agentprime.io/advisories/CVE-2026-111218.md)
  `CVE-2026-111218` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID](https://agentprime.io/advisories/CVE-2026-111217.md)
  `CVE-2026-111217` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP](https://agentprime.io/advisories/CVE-2026-111216.md)
  `CVE-2026-111216` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface](https://agentprime.io/advisories/CVE-2026-111215.md)
  `CVE-2026-111215` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php](https://agentprime.io/advisories/CVE-2026-111214.md)
  `CVE-2026-111214` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Path traversal in Netgate pfSense Plus and others](https://agentprime.io/advisories/CVE-2026-97730.md)
  `CVE-2026-97730` · CVE record: Netgate pfSense Plus and 1 more · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php](https://agentprime.io/advisories/CVE-2026-56128.md)
  `CVE-2026-56128` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS)
- [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php](https://agentprime.io/advisories/CVE-2026-56127.md)
  `CVE-2026-56127` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS)
- [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php](https://agentprime.io/advisories/CVE-2026-56126.md)
  `CVE-2026-56126` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS)
- [pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record](https://agentprime.io/advisories/CVE-2026-67189.md)
  `CVE-2026-67189` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-34178.md)
  `CVE-2025-34178` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-34177.md)
  `CVE-2025-34177` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure](https://agentprime.io/advisories/CVE-2025-34176.md)
  `CVE-2025-34176` · CVE record: Netgate pfSense CE · CVSS 5.3 Medium · EPSS 0.17 · Not analysed yet · Published 9 Sept 2025 · Tags: Path traversal
- [Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-34175.md)
  `CVE-2025-34175` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · EPSS 0.21 · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-34174.md)
  `CVE-2025-34174` · CVE record: Netgate pfSense CE · CVSS 5.1 Medium · EPSS 0.14 · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure](https://agentprime.io/advisories/CVE-2025-34173.md)
  `CVE-2025-34173` · CVE record: Netgate pfSense CE · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Path traversal
- [Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-34172.md)
  `CVE-2025-34172` · CVE record: Netgate pfSense CE · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=netgate-pfsense-ce>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/netgate-pfsense-ce/>. Everything for agents: <https://agentprime.io/llms.txt>.