Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OPNsense — Vulnerabilities & Security Advisories 28

Browse all 28 CVE security advisories affecting OPNsense. AI-powered Chinese analysis, POCs, and references for each vulnerability.

OPNsense serves as a firewall and routing platform primarily for network security and traffic management. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation, often stemming from web interface components or authentication flaws. The platform maintains a security-focused design with regular updates and a modular architecture. While no major public incidents have been widely documented, the 13 recorded CVEs highlight potential risks in areas like API endpoints and service configurations. Its open-source nature allows for community scrutiny but also requires diligent patch management to address emerging threats in network security appliances.

Found 17 results / 28 Clear Filters
Top products by OPNsense: core OPNsense
CVE ID Title CVSS Severity Published
CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection — core CWE-863 7.1 High 2026-10-15
CVE-2026-63442 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking — core CWE-117 8.1 High 2026-10-15
CVE-2026-58390 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views — core CWE-79 8.0 High 2026-10-15
CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description — core CWE-79 5.2 Medium 2026-10-15
CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS — core CWE-79 5.4 Medium 2026-10-15
CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete — core CWE-643 4.3 Medium 2026-10-15
CVE-2026-58393 OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files — core CWE-22 5.9 Medium 2026-10-15
CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer — core CWE-22 9.9 Critical 2026-10-15
CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout — core CWE-79 5.4 Medium 2026-10-15
CVE-2026-53582 OPNsense: XPATH Injection can disclose any secret in config.xml — core CWE-91 7.1 High 2026-10-15
CVE-2026-53581 ntp: write path traversal — core CWE-22 9.0 Critical 2026-09-08
CVE-2026-45158 OPNsense: Command Injection via Attacker-Controlled DHCP Config — core CWE-88 9.1 Critical 2026-05-13
CVE-2026-44194 OPNsense: RCE on user managment — core CWE-78 9.1 Critical 2026-05-13
CVE-2026-44195 OPNsense: Authentication lockout bypass — core CWE-307 5.3 Medium 2026-05-13
CVE-2026-44193 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method — core CWE-88 9.1 Critical 2026-05-13
CVE-2026-34578 OPNsense has an LDAP Injection via Unsanitized Username in Authentication — core CWE-90 8.2 High 2026-04-09
CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core — core CWE-352 6.3 Medium 2026-03-11

This page lists every published CVE security advisory associated with OPNsense. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.