77
CVEs
4
Critical
32
High
0
KEV
46
PoC
26
Unpatched C/H
27.3%
Patch Rate
14.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
32
MEDIUM
39
LOW
2
Monthly CVE Trend
Affected Products (30)
PHP
47
Pfsense
42
Pfsense Ce
29
Pfsense Plus
14
Open Redirect
2
Pfblockerng
2
Suricata
2
Suricata Package
2
Apcupsd
2
Freebsd
2
Debian Linux
2
Snort Package
2
Erlang
1
Opnsense
1
Xshell 7
1
Paramiko
1
Pkixssh
1
Transmit 5
1
Openshift Container Platform
1
Node.js
1
Sshlib
1
Pfsense Pkg Frr
1
Net Ssh
1
Ssh Server
1
Securecrt
1
Openshift Virtualization
1
Ssh2
1
Lcos Fx
1
Java
1
Libssh
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-48795 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%. | MEDIUM | 5.9 | 53.6% | 103 |
PoC
|
| CVE-2015-2295 | Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 34.6%. | MEDIUM | 6.8 | 34.6% | 89 |
PoC
No patch
|
| CVE-2022-31814 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 87.2% | 84 |
PoC
No patch
|
| CVE-2023-27253 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 90.7% | 79 |
PoC
|
| CVE-2026-111214 | OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users. | HIGH | 8.6 | 8.6% | 72 |
PoC
No patch
|
| CVE-2026-111218 | OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow. | HIGH | 8.6 | 8.4% | 71 |
PoC
No patch
|
| CVE-2026-111215 | Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface. | HIGH | 8.6 | 7.1% | 70 |
PoC
No patch
|
| CVE-2026-111217 | Command injection in Netgate pfSense CE through 2.9.0 allows an authenticated user with Virtual IP (CARP) edit privileges to execute commands as root by storing a malicious VHID value that is later interpolated into ifconfig calls or CARP status rendering. Publicly available exploit code exists, and the independent assessment rates this as a privilege-gated high-impact issue rather than an unauthenticated remote compromise; CISA KEV does not confirm active exploitation in the supplied data. Affected deployments are those where administrators or delegated operators can create or modify CARP VIPs, narrowing realistic risk to insiders or attackers who already hold privileged firewall UI access. | HIGH | 8.6 | 7.1% | 70 |
PoC
No patch
|
| CVE-2026-111216 | OS command injection in Netgate pfSense CE (through 2.9.0) allows remote attackers holding an authenticated web-GUI account with gateway edit privileges to execute arbitrary commands as root by planting shell metacharacters in the zone index of an IPv6 link-local gateway Monitor IP, which start_dpinger() passes unescaped into the dpinger shell command when gateway monitoring is applied. Exploitation requires high privileges (CVSS 4.0 PR:H) and no victim interaction (UI:N), but yields high confidentiality, integrity and availability impact on the firewall itself; publicly available exploit code exists (abraxas/pfsense-gw-ipv6-zone) with no confirmed active exploitation reported. This is a genuine but access-gated priority: unauthenticated or low-privileged users cannot reach the vulnerable gateway-edit path, so exposure is limited to deployments where such configuration rights are delegated. | HIGH | 8.6 | 6.5% | 70 |
PoC
No patch
|
| CVE-2026-111226 | Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection. | HIGH | 8.6 | 6.5% | 70 |
PoC
No patch
|
| CVE-2026-111229 | Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency. | HIGH | 8.6 | 6.4% | 69 |
PoC
No patch
|
| CVE-2023-27100 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 9.8% | 69 |
PoC
|
| CVE-2019-16701 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 19.6% | 64 |
PoC
No patch
|
| CVE-2019-16667 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 54.5% | 64 |
PoC
No patch
|
| CVE-2026-111231 | Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact. | HIGH | 8.6 | 0.9% | 64 |
PoC
No patch
|