# Netgate pfSense Plus vulnerabilities

Source: https://junglewise.ai/threats/technologies/pfsense-plus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pfsense-plus.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 12 vulnerabilities in Netgate pfSense Plus: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97730, was published on 25 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 6
- All time: 12 (0 critical, 0 exploited in the wild)

## About Netgate pfSense Plus

Open-source firewall and router operating system based on FreeBSD.

## Latest Netgate pfSense Plus vulnerabilities

- [CVE-2026-97730: Netgate pfSense local file inclusion in Dashboard widget](https://junglewise.ai/threats/cve-2026-97730-in-netgate-pfsense-plus-before-26-07-and-pfsense-ce-before-2-9-0) (high, CVSS 8.5, published 25 Sep 2026)
- [CVE-2026-78849: Netgate pfSense stored cross-site scripting in Captive Portal widget](https://junglewise.ai/threats/cve-2026-78849-netgate-pfsense-stored-cross-site-scripting-in-captive-portal) (medium, CVSS 5.4, published 4 Sep 2026)
- [CVE-2026-38961: Netgate pfSense RSS widget stored XSS in feed titles](https://junglewise.ai/threats/cve-2026-38961-netgate-pfsense-rss-widget-stored-xss-in-feed-titles) (medium, CVSS 5.4, published 4 Sep 2026)
- [CVE-2026-56128: Netgate pfSense stored XSS in firewall rule schedules](https://junglewise.ai/threats/cve-2026-56128-netgate-pfsense-stored-xss-in-firewall-rule-schedules) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2026-56127: Netgate pfSense stored XSS in firewall log descriptions](https://junglewise.ai/threats/cve-2026-56127-netgate-pfsense-stored-xss-in-firewall-log-descriptions) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2026-56126: Netgate pfSense stored XSS in Status Monitoring](https://junglewise.ai/threats/cve-2026-56126-netgate-pfsense-stored-xss-in-status-monitoring) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2025-34178: Netgate pfSense Suricata stored XSS in suricata_app_parsers.php](https://junglewise.ai/threats/cve-2025-34178-netgate-pfsense-suricata-stored-xss-in-suricata-app-parsers-php) (medium, CVSS 5.4, published 9 Sep 2025)
- [CVE-2025-34177: Netgate pfSense Suricata stored XSS in suricata_flow_stream.php](https://junglewise.ai/threats/cve-2025-34177-netgate-pfsense-suricata-stored-xss-in-suricata-flow-stream-php) (medium, CVSS 5.4, published 9 Sep 2025)
- [CVE-2025-34176: Netgate pfSense Suricata directory traversal in suricata_ip_reputation.php](https://junglewise.ai/threats/cve-2025-34176-netgate-pfsense-suricata-directory-traversal-in-suricata-ip) (medium, CVSS 4.3, published 9 Sep 2025)
- [CVE-2025-34175: Netgate pfSense Suricata reflected XSS in suricata_filecheck.php](https://junglewise.ai/threats/cve-2025-34175-netgate-pfsense-suricata-reflected-xss-in-suricata-filecheck-php) (medium, CVSS 6.1, published 9 Sep 2025)
- [CVE-2025-34173: Netgate pfSense Snort package directory traversal in snort_ip_reputation.php](https://junglewise.ai/threats/cve-2025-34173-netgate-pfsense-snort-package-directory-traversal-in-snort-ip) (medium, CVSS 4.3, published 9 Sep 2025)
- [CVE-2025-34172: Netgate pfSense HAProxy reflected XSS in haproxy_stats.php](https://junglewise.ai/threats/cve-2025-34172-netgate-pfsense-haproxy-reflected-xss-in-haproxy-stats-php) (medium, CVSS 6.1, published 9 Sep 2025)

## Most severe Netgate pfSense Plus vulnerabilities

- [CVE-2026-97730: Netgate pfSense local file inclusion in Dashboard widget](https://junglewise.ai/threats/cve-2026-97730-in-netgate-pfsense-plus-before-26-07-and-pfsense-ce-before-2-9-0) (high, CVSS 8.5, published 25 Sep 2026)
- [CVE-2025-34175: Netgate pfSense Suricata reflected XSS in suricata_filecheck.php](https://junglewise.ai/threats/cve-2025-34175-netgate-pfsense-suricata-reflected-xss-in-suricata-filecheck-php) (medium, CVSS 6.1, published 9 Sep 2025)
- [CVE-2025-34172: Netgate pfSense HAProxy reflected XSS in haproxy_stats.php](https://junglewise.ai/threats/cve-2025-34172-netgate-pfsense-haproxy-reflected-xss-in-haproxy-stats-php) (medium, CVSS 6.1, published 9 Sep 2025)
- [CVE-2025-34178: Netgate pfSense Suricata stored XSS in suricata_app_parsers.php](https://junglewise.ai/threats/cve-2025-34178-netgate-pfsense-suricata-stored-xss-in-suricata-app-parsers-php) (medium, CVSS 5.4, published 9 Sep 2025)
- [CVE-2026-56128: Netgate pfSense stored XSS in firewall rule schedules](https://junglewise.ai/threats/cve-2026-56128-netgate-pfsense-stored-xss-in-firewall-rule-schedules) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2026-56127: Netgate pfSense stored XSS in firewall log descriptions](https://junglewise.ai/threats/cve-2026-56127-netgate-pfsense-stored-xss-in-firewall-log-descriptions) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2026-56126: Netgate pfSense stored XSS in Status Monitoring](https://junglewise.ai/threats/cve-2026-56126-netgate-pfsense-stored-xss-in-status-monitoring) (medium, CVSS 5.4, published 3 Sep 2026)
- [CVE-2025-34177: Netgate pfSense Suricata stored XSS in suricata_flow_stream.php](https://junglewise.ai/threats/cve-2025-34177-netgate-pfsense-suricata-stored-xss-in-suricata-flow-stream-php) (medium, CVSS 5.4, published 9 Sep 2025)
- [CVE-2026-78849: Netgate pfSense stored cross-site scripting in Captive Portal widget](https://junglewise.ai/threats/cve-2026-78849-netgate-pfsense-stored-cross-site-scripting-in-captive-portal) (medium, CVSS 5.4, published 4 Sep 2026)
- [CVE-2026-38961: Netgate pfSense RSS widget stored XSS in feed titles](https://junglewise.ai/threats/cve-2026-38961-netgate-pfsense-rss-widget-stored-xss-in-feed-titles) (medium, CVSS 5.4, published 4 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 5 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 1 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Netgate technologies

- [Netgate pfSense CE](https://junglewise.ai/threats/technologies/pfsense-ce): 31 vulnerabilities
- [Netgate Suricata package for pfSense](https://junglewise.ai/threats/technologies/suricata-package-for-pfsense): 4 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Netgate pfSense Plus vulnerabilities", https://junglewise.ai/threats/technologies/pfsense-plus, 9 November 2026.