Netgate vulnerabilities
39 CVEs and advisories name Netgate as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111233Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
- CVE-2026-111232Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
- CVE-2026-111230Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
- CVE-2026-111228Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
- CVE-2026-111227Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
- CVE-2026-111226Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
- CVE-2026-111225Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
- CVE-2026-111224Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
- CVE-2026-111223Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
- CVE-2026-111222Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
- CVE-2026-111220Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
- CVE-2026-111219Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
- CVE-2026-111218Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
- CVE-2026-111217Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
- CVE-2026-111216Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
- CVE-2026-111215Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
- CVE-2026-111214Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
- CVE-2026-110908Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR s
- CVE-2026-97730In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) wi
- CVE-2026-56128pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
- CVE-2026-56127pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
- CVE-2026-56126pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
- CVE-2026-67189pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
- CVE-2016-20058Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation
- CVE-2016-20057NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation
- CVE-2019-25271NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path
- CVE-2019-25269Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability
- CVE-2025-12490Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability
- CVE-2025-34178Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
- CVE-2025-34177Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting