Opnsense vulnerabilities
36 CVEs and advisories name Opnsense as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123025An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin…
- CVE-2026-57154OPNsense: Configuration line injection via multiple GUI text fields
- CVE-2026-119560OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
- CVE-2026-119425OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
- CVE-2026-119424OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
- CVE-2026-119423OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
- CVE-2026-119409OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
- CVE-2026-115425Multiple cross-site scripting (XSS) in OPNsense
- CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
- CVE-2026-63442OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
- CVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
- CVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate Description
- CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS
- CVE-2026-58395OPNsense: XPath injection in MVC safe-delete
- CVE-2026-58393OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
- CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
- CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
- CVE-2026-53582OPNsense: XPATH Injection can disclose any secret in config.xml
- CVE-2026-53581ntp: write path traversal
- CVE-2026-45158OPNsense: Command Injection via Attacker-Controlled DHCP Config
- CVE-2026-44194OPNsense: RCE on user managment
- CVE-2026-44195OPNsense: Authentication lockout bypass
- CVE-2026-44193OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
- CVE-2026-34578OPNsense has an LDAP Injection via Unsanitized Username in Authentication
- CVE-2026-30868Cross-Site Request Forgery (CSRF) in opnsense/core
- CVE-2019-25377OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php
- CVE-2019-25376OPNsense 19.1 Reflected XSS via proxy endpoint
- CVE-2019-25375OPNsense 19.1 Reflected XSS via monit interface
- CVE-2019-25374OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php
- CVE-2019-25373OPNsense 19.1 Stored XSS via firewall_rules_edit.php