Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4 results
Oct 21, 2026The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls.CVE-2026-113779 · Other software · pfrest · reported by GitHubHigh 8.8
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA
- Product
- pfSense-pkg-RESTAPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22CVE-2022-26019 · Other software · pfSense · reported by vultures@jpcert.or.jpHigh 8.8
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Mar 31, 2022Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to CVE-2022-24299 · Other software · pfSense · reported by vultures@jpcert.or.jpHigh 8.8
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Mar 31, 2022Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and CVE-2021-20729 · Other software · pfSense · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
- Product
- pfSense CE and pfSense Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netgate.comjvn.jp
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.