Known Vulnerabilities for Pfsense Plus by Netgate
Listed below are 6 of the newest known vulnerabilities associated with "Pfsense Plus" by "Netgate".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-78849 json | Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 a... | Not Provided | 2026-09-04 | 2026-09-04 |
| CVE-2026-67189 json | pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Gra... | Not Provided | 2026-08-19 | 2026-08-25 |
| CVE-2026-56128 json | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to injec... | Not Provided | 2026-09-03 | 2026-09-03 |
| CVE-2026-56127 json | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject ar... | Not Provided | 2026-09-03 | 2026-09-03 |
| CVE-2026-56126 json | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbit... | Not Provided | 2026-09-03 | 2026-09-05 |
| CVE-2026-38961 json | Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (... | Not Provided | 2026-09-04 | 2026-09-04 |
| CVE-2025-34178 json | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related st... | Not Provided | 2025-09-09 | 2026-07-14 |
| CVE-2025-34177 json | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related st... | Not Provided | 2025-09-09 | 2026-07-14 |
| CVE-2025-34176 json | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversa... | Not Provided | 2025-09-09 | 2026-07-14 |
| CVE-2025-34175 json | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed with... | Not Provided | 2025-09-09 | 2026-07-14 |