Pfsense

Vendor:

First CVE: Jan 3, 2012 · Active for 14 years

24

Total CVEs

More Total CVEs than 95% of tracked products

3.4

Avg CVEs / Year

Higher CVE frequency than 82% of tracked products

6.7

Avg CVSS

Higher Avg CVSS than 34% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Pfsense over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jan 3, 2012

14 years ago

Most Recent CVE

May 8, 2026

79 days ago

CVE Severity & Scoring

Pfsense24 CVEs

63%

21%

17%

All CVEs352,713 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network22 (91.7%)

Unknown2 (8.3%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low22 (91.7%)

High0 (0.0%)

Unknown2 (8.3%)

User Interaction

None12 (50.0%)

Unknown2 (8.3%)

Required10 (41.7%)

Privileges Required

Low10 (41.7%)

High3 (12.5%)

None9 (37.5%)

Unknown2 (8.3%)

Top CVEs

Signals from CVEs in this product scope (24 CVEs).

24 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2021-41282HIGH diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by	Mar 1, 2022	8.8	88	NO	YES
CVE-2016-10709HIGH pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '\|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img	Jan 22, 2018	8.8	58	NO	YES
CVE-2023-27100CRITICAL Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to byp	Mar 22, 2023	9.8	45	NO	YES
CVE-2025-69691CRITICAL Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they ar	May 8, 2026	9.9	36	NO	NO
CVE-2025-69690CRITICAL Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the	May 8, 2026	9.1	34	NO	NO
CVE-2021-27933MEDIUM pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.	Apr 28, 2021	6.1	33	NO	NO
CVE-2025-34175MEDIUM In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This	Sep 9, 2025	6.1	29	NO	NO
CVE-2020-19678HIGH Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter	Apr 6, 2023	7.5	26	NO	NO
CVE-2025-34176MEDIUM In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly use	Sep 9, 2025	4.3	25	NO	NO
CVE-2023-29974CRITICAL An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.	Nov 8, 2023	9.8	24	NO	NO

View all 24 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (24 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

2 CVEs

8.3% of CVEs· 97th percentile

Nuclei

1 CVE

4.2% of CVEs· 97th percentile

ExploitDB

1 CVE

4.2% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (24 CVEs).

Media Mentions

Signals from CVEs in this product scope (24 CVEs).

Top CNAs Publishing CVEs For Pfsense

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
2.8.0	2	8.2	1.2%	0
2.7.2	1	9.1	0.6%	0
2.6.0	4	7.9	3.7%	1
2.5.2	2	7.5	44.8%	1
2.5.0	1	6.1	26.6%	0
2.4.5	1	5.4	5.3%	0
2.1.3	1	7.5	3.5%	0
1.2.3	2	5.9	1.6%	0
1.2.2	2	5.9	1.6%	0
1.2.1	2	5.9	1.6%	0
1.0.x	2	5.9	1.6%	0