These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross Site Scripting vulnerability exists in Netgate pfSense 26.03.1-RELEASE, which could potentially allow an attacker to execute arbitrary code via the pfBlockerNG package. The CVE record was published on 2026-09-25T13:17:16.170Z and has not been modified since then. The NVD entry is currently 6.1, MEDIUM. This vulnerability affects pfSense installations using the pfBlockerNG package, and defenders sh [truncated]
CVE-2026-97730 is a Local File Inclusion (LFI) vulnerability in Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0. An authenticated attacker can execute arbitrary PHP code by modifying Dashboard settings and writing arbitrary files to the pfSense firewall system. This vulnerability allows for potential arbitrary PHP code execution on pfSense systems, possible escalation of privileges for authe [truncated]
A Cross Site Scripting vulnerability exists in Netgate pfSense Plus software versions <= 26.03 and pfSense CE software versions <= 2.8.1. This vulnerability allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file. The CVSS score is 5.4, indicating a medium severity. Affected product deployments should be identified and assessed for exposure. Official advisories and [truncated]
CVE-2026-56128 is a stored cross-site scripting (XSS) vulnerability affecting pfSense Plus before 26.07 and CE before 2.9.0. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected sche [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T20:17:20.740Z and has not been modified since then. The vulnerability affects pfSense Plus before 26.07 and pfSense CE through 2.8.1, and is a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature. An attacker who controls a PTR record and generates sufficient traffi [truncated]
CVE-2016-20058 is a high-severity vulnerability in Netgate AMITI Antivirus build 23.0.305. The vulnerability is caused by an unquoted service path in the AmitiAvSrv and AmitiAntivirusHealth services, which allows local attackers to escalate privileges. To exploit this vulnerability, an attacker can place a malicious executable in the unquoted service path and trigger a service restart or system reboot to [truncated]
PatchSiren debrief for CVE-2016-20057: NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service. This allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.