OPNsense vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
35 matching records
- Medium6.9OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login UsernameCheck if you run itEPSS 0.38%Oct 30, 2026
- Medium6.4CA/Cert PEM Imported Payload Allows OpenVPN Directive Injection Leading to Root OS Command ExecutionOpen the advisoryOct 29, 2026
- High7.2Authenticated Root Command Injection via Firmware Mirror Configuration in OPNsenseOpen the advisoryOct 28, 2026
- UnknownOPNsense: Mehrere SchwachstellenCheck if you run itEPSS 0.29%Oct 26, 2026
- Medium5.9OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.43%Oct 15, 2026
- High8.0OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.60%Oct 15, 2026
- High7.1OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.73%Oct 15, 2026
- Medium4.3Password-policy lock is cleared by an empty-password Save on system_usermanager_passwordmg.php (CWE-863/696)Open the advisorySep 30, 2026
- Medium5.3Audit log injection via login username in auth_log()Open the advisorySep 15, 2026
- Medium5.4Captive Portal roaming authorizes attacker-controlled IPs through forged ARP bindingsOpen the advisoryAug 26, 2026
- LowMultiple cross-site scripting (XSS) in OPNsense 26.7.1_1 Architecture amd64 08d6a7847Open the advisoryAug 12, 2026
- Medium4.8GHSA-6vv6-fpw9-8r2g is listed by Certificate and CA descriptions render unescaped in the wireless EAP selectors on interfaces.php.Open the advisoryAug 12, 2026
- Medium6.5OpenVPN session kill endpoint executes arbitrary management protocol commands through unvalidated (delegated status user to daemon control)Open the advisoryAug 12, 2026
- Medium5.2Stored XSS via Unsafe Attribute Construction and Field HTML InsertionOpen the advisoryAug 12, 2026
- Medium5.9OpenVPN Client Export Utility users can export private keys for unlisted certificate refsOpen the advisoryJul 21, 2026
- Medium5.3Unauthenticated lighttpd request-body disk exhaustionOpen the advisoryJul 21, 2026
- High7.6Manual Config::save() paths bypass user-config-readonly enforcementOpen the advisoryJul 21, 2026
- Medium6.3Multiple Stored XSSOpen the advisoryJul 21, 2026
- High7.1OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.38%Jul 2, 2026
- High8.1OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.29%Jul 1, 2026
- Medium5.2OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.24%Jul 1, 2026
- Medium4.3OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.36%Jul 1, 2026
- Medium5.4OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.27%Jul 1, 2026
- Medium5.4OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.27%Jul 1, 2026
- Critical9.9OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.86%Jul 1, 2026