https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T15:10:54.741019+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111231 CVE-2026-111231 — Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() 2026-10-17T15:10:54.742920+00:00

Affected: Netgate pfSense CE

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.