CVE-2026-38961

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-38961

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38961.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-38961

Published

2026-09-04T00:00:00Z

Modified

2026-09-06T03:45:51.698669907Z

Summary

[none]

Details

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38961.json"
}

References

Affected packages

Git / github.com/pfsense/pfsense

Affected ranges

Type

GIT

Repo

https://github.com/pfsense/pfsense

Events

Introduced

Fixed

9363ac5b8651a1c7a333180425ce7719070f95f9

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

Other

RELENG_2_2_BETA

Root_RELENG_1_2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38961.json"