opnsense core vulnerabilities
23 published CVEs name opnsense core among the affected products.
- 23Published CVEs23 of them scored
- 23Last 12 monthspublished in the last year
- 5Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-57154
OPNsense: Configuration line injection via multiple GUI text fields
opnsense · core
High8.1 - CVE-2026-119560
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
opnsense · core
Medium6.0 - CVE-2026-119425
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
opnsense · core
Medium5.3 - CVE-2026-119424
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
opnsense · core
Medium6.1 - CVE-2026-119423
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
opnsense · core
Medium6.9 - CVE-2026-119409
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
opnsense · core
High8.6 - CVE-2026-71490
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
opnsense · core
High7.1 - CVE-2026-63442
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
opnsense · core
High8.1 - CVE-2026-58390
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
opnsense · core
High8.0 - CVE-2026-58394
OPNsense: Stored XSS in Administration Settings via Certificate Description
opnsense · core
Medium5.2