Netgate pfSense Code Execution

The vulnerability in the deletequeue function of the Netgate pfSense software firewall is related to improper handling of special elements. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

CVE-2026-111218

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111218

Netgate pfSense CE 2.7.0 through 2.9.0 is vulnerable to an OS command injection vulnerability within the Traffic Shaper Limiters . Authenticated users possessing Traffic Shaper Limiters privileges can execute commands as root by tampering with the limiter number field . The flaw occurs because th...

EUVD-2026-102330

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111218: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...