# cve.now: Opnsense

The newest entries naming Opnsense as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123025](https://cve.now/CVE-2026-123025.md): An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin… (CVSS 9.4)
- [CVE-2026-57154](https://cve.now/CVE-2026-57154.md): OPNsense: Configuration line injection via multiple GUI text fields (CVSS 8.1)
- [CVE-2026-119560](https://cve.now/CVE-2026-119560.md): OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields (CVSS 6.0)
- [CVE-2026-119425](https://cve.now/CVE-2026-119425.md): OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP (CVSS 5.3)
- [CVE-2026-119424](https://cve.now/CVE-2026-119424.md): OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity (CVSS 6.1)
- [CVE-2026-119423](https://cve.now/CVE-2026-119423.md): OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username (CVSS 6.9)
- [CVE-2026-119409](https://cve.now/CVE-2026-119409.md): OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting (CVSS 8.6)
- [CVE-2026-115425](https://cve.now/CVE-2026-115425.md): Multiple cross-site scripting (XSS) in OPNsense (CVSS 5.6)
- [CVE-2026-71490](https://cve.now/CVE-2026-71490.md): OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection (CVSS 7.1)
- [CVE-2026-63442](https://cve.now/CVE-2026-63442.md): OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking (CVSS 8.1)
- [CVE-2026-58390](https://cve.now/CVE-2026-58390.md): OPNsense: Stored XSS to root RCE via OpenVPN client common\_name in status views (CVSS 8.0)
- [CVE-2026-58394](https://cve.now/CVE-2026-58394.md): OPNsense: Stored XSS in Administration Settings via Certificate Description (CVSS 5.2)
- [CVE-2026-58392](https://cve.now/CVE-2026-58392.md): OPNsense: Stored XSS in Services: NTP GPS (CVSS 5.4)
- [CVE-2026-58395](https://cve.now/CVE-2026-58395.md): OPNsense: XPath injection in MVC safe-delete (CVSS 4.3)
- [CVE-2026-58393](https://cve.now/CVE-2026-58393.md): OPNsense: OpenVPN Client Specific Override common\_name allows path traversal in generated CSO files (CVSS 5.9)
- [CVE-2026-57155](https://cve.now/CVE-2026-57155.md): OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer (CVSS 9.9)
- [CVE-2026-58391](https://cve.now/CVE-2026-58391.md): OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout (CVSS 5.4)
- [CVE-2026-53582](https://cve.now/CVE-2026-53582.md): OPNsense: XPATH Injection can disclose any secret in config.xml (CVSS 7.1)
- [CVE-2026-53581](https://cve.now/CVE-2026-53581.md): ntp: write path traversal (CVSS 9.0)
- [CVE-2026-45158](https://cve.now/CVE-2026-45158.md): OPNsense: Command Injection via Attacker-Controlled DHCP Config (CVSS 9.1)
- [CVE-2026-44194](https://cve.now/CVE-2026-44194.md): OPNsense: RCE on user managment (CVSS 9.1)
- [CVE-2026-44195](https://cve.now/CVE-2026-44195.md): OPNsense: Authentication lockout bypass (CVSS 5.3)
- [CVE-2026-44193](https://cve.now/CVE-2026-44193.md): OPNsense: RCE via XMLRPC endpoint using \`opnsense.restore\_config\_section\` method (CVSS 9.1)
- [CVE-2026-34578](https://cve.now/CVE-2026-34578.md): OPNsense has an LDAP Injection via Unsanitized Username in Authentication (CVSS 8.2)
- [CVE-2026-30868](https://cve.now/CVE-2026-30868.md): Cross-Site Request Forgery (CSRF) in opnsense/core (CVSS 6.3)
- [CVE-2019-25377](https://cve.now/CVE-2019-25377.md): OPNsense 19.1 Reflected XSS via system\_advanced\_sysctl.php (CVSS 4.8)
- [CVE-2019-25376](https://cve.now/CVE-2019-25376.md): OPNsense 19.1 Reflected XSS via proxy endpoint (CVSS 5.1)
- [CVE-2019-25375](https://cve.now/CVE-2019-25375.md): OPNsense 19.1 Reflected XSS via monit interface (CVSS 5.1)
- [CVE-2019-25374](https://cve.now/CVE-2019-25374.md): OPNsense 19.1 Reflected XSS via vpn\_ipsec\_settings.php (CVSS 5.1)
- [CVE-2019-25373](https://cve.now/CVE-2019-25373.md): OPNsense 19.1 Stored XSS via firewall\_rules\_edit.php (CVSS 5.1)
- [CVE-2019-25372](https://cve.now/CVE-2019-25372.md): OPNsense 19.1 Reflected XSS via diag\_traceroute.php (CVSS 5.1)
- [CVE-2019-25371](https://cve.now/CVE-2019-25371.md): OPNsense 19.1 Reflected XSS via diag\_ping.php (CVSS 5.1)
- [CVE-2019-25370](https://cve.now/CVE-2019-25370.md): OPNsense 19.1 Reflected XSS via interfaces\_vlan\_edit.php (CVSS 5.1)
- [CVE-2019-25369](https://cve.now/CVE-2019-25369.md): OPNsense 19.1 Stored XSS via system\_advanced\_sysctl.php (CVSS 5.1)
- [CVE-2019-25368](https://cve.now/CVE-2019-25368.md): OPNsense 19.1 Reflected XSS via diag\_backup.php (CVSS 4.8)
- [CVE-2025-50989](https://cve.now/CVE-2025-50989.md): OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces\_bridge\_ed (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/opnsense
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.