CVE-2026-111214

Netgate pfSense CE versions 2.7.0 through 2.9.0 are vulnerable to an OS command injection flaw within the interfaces_qinq_edit.php component. The root cause is the storage of an unvalidated parent interface name . An authenticated user with QinQ edit privileges can save a crafted 'if ' value; whe...

CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

CVE-2026-111215

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection flaw. The vulnerability exists because the interface_wireless_clone() function interpolates unescaped input into an ifconfig shell command. Authenticated users with limited Wireless Edit or Interface Assignments pri...

liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — Vulnerability Research RAPTOR Loop-Hunt A security audit of Liferay Portal CE 7.0.3 GA4 git tag 7.0.3-ga4, commit b2d7cc68a performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents...

CVE-2026-85706-PoC

CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read CVE-2026-85706 is a critical path-traversal / missing-authentication issue in the GitLab CE/EE Repository Commits and Repository Files APIs: an unauthenticated attacker can make the server read arbitrary files and obtain their...

CVE-2026-111214: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

GitLab < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-14814)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cach...

CVE-2026-111222: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo,...

CVE-2026-111232: Improper Neutralization of Input During Web Page Generation

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator color value that...

CVE-2026-111216: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

PT-2026-115179

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

PT-2026-115182

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface...

CVE-2026-111231: Incorrect Authorization

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111221: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-111230: External Control of File Name or Path

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111215: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...

PT-2026-115196

Name of the Vulnerable Software and Affected Versions Netgate pfSense CE versions prior to 2.9.0 Description An authorization bypass exists that allows read-only WebGUI users to replace the config.xml file. This occurs because the config restore and config install functions ignore the User -...

CVE-2026-111218: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111225: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111233: Improper Neutralization of Input During Web Page Generation

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...