Overview 10 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
10matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC10.0%
2EPSS ≥ 0.520.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
10
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
10
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
10.0%
Proof of concept only
0
0.0%
Forecast only
2
20.0%
No public exploit
7
70.0%
split by
peak 4 / quarter
Q1 224
Not applicable4
High2
Medium2
not blocked4
No public exploit4
Q2 220
Q3 220
Q4 220
Q1 231
Not applicable1
Critical1
not blocked1
Working exploit published1
Q2 230
Q3 230
Q4 232
Not applicable2
High2
not blocked2
Forecast only2
Q1 240
Q2 240
Q3 240
Q4 240
Q1 250
Q2 253
Not applicable3
High1
Medium2
not blocked3
No public exploit3
Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-57273 | Medium | 2025-05-14 | Not applicable | No public exploit | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key. |
| CVE-2024-54780 | High | 2025-05-14 | Not applicable | No public exploit | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter. |
| CVE-2024-54779 | Medium | 2025-05-14 | Not applicable | No public exploit | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. |
| CVE-2023-48123 | High | 2023-12-06 | Not applicable | Forecast only | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. |
| CVE-2023-42326 | High | 2023-11-14 | Not applicable | Forecast only | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. |
| CVE-2023-27100 | Critical | 2023-03-22 | Not applicable | Working exploit published | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests. |
| CVE-2022-26019 | High | 2022-03-31 | Not applicable | No public exploit | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution. |
| CVE-2022-24299 | High | 2022-03-31 | Not applicable | No public exploit | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command. |
| CVE-2021-20729 | Medium | 2022-03-31 | Not applicable | No public exploit | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL. |
| CVE-2022-23993 | Medium | 2022-01-26 | Not applicable | No public exploit | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS. |