Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Netgate pfSense CE, pfSense Plus 2.9.0, 26.07 Clear all filters
TI-2026-40506 CVE-2026-56128 · GHSA-xqh2-9r6g-5jrx

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

Priority LOW 25

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.01052 Published 2026-09-03 Fixed in 26.07, 2.9.0 CWE-79
TI-2026-40505 CVE-2026-56127 · GHSA-3c8g-23wp-3mx8

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

Priority LOW 25

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.01052 Published 2026-09-03 Fixed in 26.07, 2.9.0 CWE-79
TI-2026-40504 CVE-2026-56126 · GHSA-2356-p4rp-xj6q

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

Priority LOW 25

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.01052 Published 2026-09-03 Fixed in 26.07, 2.9.0 CWE-79