Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: opnsense core 26.7.8 Clear all filters
TI-2026-83003 CVE-2026-119424 · GHSA-r639-jmpp-wf8p

Configuration line injection in OPNsense wireless WPA settings

Priority LOW 30

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-10-30 Fixed in 26.7.8 CWE-93
TI-2026-83002 CVE-2026-119423 · GHSA-m68j-m67p-c39j

Log injection in OPNsense lets attackers lock out victim IP addresses

Priority LOW 37

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-10-30 Fixed in 26.7.8 CWE-117
TI-2026-82992 CVE-2026-119409 · GHSA-q3x8-9859-gj9r

Command injection in OPNsense firmware mirror setting allows root access

Priority MEDIUM 44

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.02477 Published 2026-10-30 Fixed in 26.7.8 CWE-78