Netgate pfSense

Name: Netgate pfSense
Brand: Netgate

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

critical

by severity

0critical15high17medium0low

updated 2026-10-27

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-53392US	medium6.5	1.85% (79th)	Exploit	no fix	2025-06-28	≤ 2.8.0
CVE-2025-34175US	medium6.1	21.3% (98th)	—	no fix	2025-09-09	5 versions
CVE-2025-34176US	medium4.3	17.3% (97th)	—	no fix	2025-09-09	5 versions
CVE-2025-12490US	—	17.0% (97th)	—	no fix	2025-11-06	≤ pfSense 2.8.1, Suricata package 7.0.8_3
CVE-2025-34174US	medium5.4	14.5% (97th)	—	no fix	2025-09-09	5 versions
CVE-2024-54780US	—	12.7% (96th)	—	2.8.0 beta	2025-05-14	3 versions
CVE-2026-111214US	high7.2	10.8% (96th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111218US	high7.2	8.65% (95th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2024-54779US	—	8.52% (95th)	—	2.8.0 beta	2025-05-14	3 versions
CVE-2026-111217US	high7.2	6.96% (94th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111226US	high7.2	6.55% (94th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111229US	high7.2	6.37% (94th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111215US	high7.2	6.25% (94th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111225US	high8.8	6.21% (93rd)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-110908US	—	6.08% (93rd)	—	no fix	2026-10-15	4 versions
CVE-2025-34178US	medium5.4	5.49% (93rd)	—	no fix	2025-09-09	5 versions
CVE-2026-111224US	high7.5	5.37% (93rd)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111216US	high7.2	4.72% (92nd)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111228US	medium5.5	1.84% (79th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111227US	medium5.5	1.84% (79th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2024-57273US	—	1.28% (70th)	—	2.8.0 beta	2025-05-14	3 versions
CVE-2026-67189US	medium6.1	1.17% (67th)	—	no fix	2026-08-19	2 versions
CVE-2025-34172US	medium6.1	1.16% (67th)	—	no fix	2025-09-09	5 versions
CVE-2026-111233US	medium6.1	1.06% (65th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-56128US	medium5.4	1.05% (64th)	—	no fix	2026-09-03	2 versions
CVE-2026-56127US	medium5.4	1.05% (64th)	—	no fix	2026-09-03	2 versions
CVE-2026-56126US	medium5.4	1.05% (64th)	—	no fix	2026-09-03	2 versions
CVE-2026-97730US	—	1.03% (63rd)	—	no fix	2026-09-25	2 versions
CVE-2026-111232US	medium4.8	1.00% (63rd)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111222US	high7.2	0.96% (61st)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2025-34177US	medium5.4	0.95% (61st)	—	no fix	2025-09-09	5 versions
CVE-2026-111221US	high7.2	0.94% (61st)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2025-34173US	medium4.3	0.92% (60th)	—	no fix	2025-09-09	5 versions
CVE-2026-111219US	high7.2	0.87% (59th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111231US	high7.2OT elevated	0.84% (58th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111230US	medium4.9	0.75% (55th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111223US	high7.2	0.75% (55th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-111220US	high7.2	0.73% (54th)	—	no fix	2026-10-15	≤ 2.9.0
CVE-2026-78849US	—	0.50% (43rd)	—	no fix	2026-09-04	2 versions
CVE-2026-38961US	—	0.28% (20th)	—	no fix	2026-09-04	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')15 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')10 CVEs
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')6 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-24Path Traversal: '../filedir'1 CVEs
CWE-36Absolute Path Traversal1 CVEs
CWE-73External Control of File Name or Path1 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)38 CVEs
EUEU Vulnerability Database (ENISA)2 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan